Analysis

  • max time kernel
    91s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 00:23

General

  • Target

    36ffe644c4a67459c2ffe39a049caffc_JaffaCakes118.exe

  • Size

    420KB

  • MD5

    36ffe644c4a67459c2ffe39a049caffc

  • SHA1

    802621d2a63e3b1cc1a2851eea12eb587d3b5ecd

  • SHA256

    df758d3c1f62d8e80fc921d80bf583acd370e4316ec846378d22b691e3d3c1b2

  • SHA512

    07f4000c8bfb8a7cb8720599558f6906ef8d5eec3bf20f8bbcc27c4e838e82e927b037d15af6d33667efde34bfb2b6febad7835b0d1cff8a0ba1423867fe0029

  • SSDEEP

    6144:/f5OCHPUnhsQ+3HwOcc0WTCI62woO8AlliWGPfDBP9eNFfPa58EYlVpk0W3sLU3:s9occ0WTd628JliVeNFfq6k0W3sLU3

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36ffe644c4a67459c2ffe39a049caffc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\36ffe644c4a67459c2ffe39a049caffc_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Users\Admin\AppData\Local\Temp\36ffe644c4a67459c2ffe39a049caffc_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\36ffe644c4a67459c2ffe39a049caffc_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1780
        3⤵
        • Program crash
        PID:3204
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3332 -ip 3332
    1⤵
      PID:4472

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\36ffe644c4a67459c2ffe39a049caffc_JaffaCakes118.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • memory/3332-11-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/3332-17-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/3332-16-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/3332-14-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/3560-4-0x0000000004FC0000-0x0000000004FCA000-memory.dmp

      Filesize

      40KB

    • memory/3560-6-0x00000000072A0000-0x000000000733C000-memory.dmp

      Filesize

      624KB

    • memory/3560-7-0x0000000005160000-0x0000000005172000-memory.dmp

      Filesize

      72KB

    • memory/3560-8-0x00000000748CE000-0x00000000748CF000-memory.dmp

      Filesize

      4KB

    • memory/3560-9-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/3560-10-0x00000000065C0000-0x000000000660C000-memory.dmp

      Filesize

      304KB

    • memory/3560-5-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/3560-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

      Filesize

      4KB

    • memory/3560-3-0x0000000004FD0000-0x0000000005062000-memory.dmp

      Filesize

      584KB

    • memory/3560-15-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/3560-2-0x00000000054E0000-0x0000000005A84000-memory.dmp

      Filesize

      5.6MB

    • memory/3560-1-0x0000000000590000-0x0000000000600000-memory.dmp

      Filesize

      448KB