snakekeylogger | 14aa67b289452fbb68197a676f9a291aae35cd72c3bc7b425e7c42645aac6d65

General

Target
3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
Size 682KB
Sample240713-c83qlascrn
SHA256 14aa67b289452fbb68197a676f9a291aae35cd72c3bc7b425e7c42645aac6d65
MD5 3fe2596f06b31058fb5614b5d9f7bc0f
SHA1 6940ec12152682a3c89a305b3ec8fdb3fbcccd20
SHA512 b04a6f6127c93487df80485adc65af14060e8c931dc3cd500b0ef5fe0f5e45a33dc6e02a308c160485612ce30bef4a4d369e9c15d3eb0a52ae5041201dce1716
SSDEEP 12288:JDs0V8RmEVoxYZuCTLWIZZBNt43NEemWZmqj:dnyRmEZuCHLNt43Nkw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1171994922:AAHrYAv7JIpM5hzPMScAJJOdE7TBb00NwJY/sendMessage?chat_id=1194949947

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Loads dropped DLL 2 IoCs

pid	Process
2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 2340	2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	2340	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
2340	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2340	2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2340	2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2340	2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2340	2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2340	2384	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2852	2340	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	32
PID 2340 wrote to memory of 2852	2340	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	32
PID 2340 wrote to memory of 2852	2340	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	32
PID 2340 wrote to memory of 2852	2340	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe	32

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1008
    3⤵
    - Program crash
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lz0xkoqy.dll

Path C:\Users\Admin\AppData\Local\Temp\lz0xkoqy.dll
Size 11KB
SHA256 de757495d61e622adffed7588acdb5eba2f18734c13eaf9e25949779f2cb75fe
MD5 1dc8118acd04962a04f537c7dabe17be
SHA1 c04648b207433324803c595b22efaafc2423bfd3
SHA512 54107302bff8bfe9179f969f13045f83281ae9aef8ab2e723f0aa540fc46dc86d2a23b79ecfd6700b2fedbf3cf729a0693887bbad772fa993a5a7ee8bb9c0475
SSDEEP 192:IRkq0eddH2mOTFM6tlPFfYamGaGQITKzWAg8CRuDqxz6:QkS8FMOl9g0aZITQ6R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsjAE0C.tmp\System.dll
Size 11KB
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2340-17-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2340-15-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2340-13-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2340-18-0x0000000001FD0000-0x0000000002038000-memory.dmp

Download

memory/2384-12-0x0000000010000000-0x0000000010006000-memory.dmp

Download

memory/2384-16-0x0000000010000000-0x0000000010006000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads