snakekeylogger | 75f2d758f27b27982c84af9f9ad2677e005a72a385e48627dfa13341a4273606

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe
Size

725KB
MD5

132eb1a40c403bc96986024b3de63dbb
SHA1

52996e976b37b7ac2a53be90864b44e7d02c1974
SHA256

75f2d758f27b27982c84af9f9ad2677e005a72a385e48627dfa13341a4273606
SHA512

2757b1baba6e0d3253e7c2aca14020b739d368684f475b72ff4d470559f3626972f522ca30a7b30379d2b78df646b0f8299615758491b391b78b819be92f95e8
SSDEEP

12288:M9yCkuvgld21fNlRULtFkcmPMUHiMySw3Tznmj0ztF9CoTYUVuwwVTMsMf:M5dvTItFk7fiEjU6WYQultTE

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: ftp
Host:
ftp://bitrix370.timeweb.ru/
Port:
21
Username:
cn94754
Password:
c2eitfpidhgS

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe

description pid process target process

PID 2108 set thread context of 2196 2108 132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 2196 WerFault.exe MSBuild.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2964 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

MSBuild.exe

pid process

2196 MSBuild.exe
2196 MSBuild.exe
2196 MSBuild.exe
2196 MSBuild.exe
2196 MSBuild.exe
2196 MSBuild.exe
2196 MSBuild.exe
2196 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2196 MSBuild.exe

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 2108 set thread context of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe

pid	pid_target	process	target process
2008	2196	WerFault.exe	MSBuild.exe

pid	process
2964	schtasks.exe

pid	process
2196	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2196	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exeMSBuild.exe

description	pid	process	target process
PID 2108 wrote to memory of 2964	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	schtasks.exe
PID 2108 wrote to memory of 2964	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	schtasks.exe
PID 2108 wrote to memory of 2964	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	schtasks.exe
PID 2108 wrote to memory of 2964	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	schtasks.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2108 wrote to memory of 2196	2108	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 2196 wrote to memory of 2008	2196	MSBuild.exe	WerFault.exe
PID 2196 wrote to memory of 2008	2196	MSBuild.exe	WerFault.exe
PID 2196 wrote to memory of 2008	2196	MSBuild.exe	WerFault.exe
PID 2196 wrote to memory of 2008	2196	MSBuild.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkoaYBUIwbGl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2C00.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 1048
3⤵
- Program crash
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2C00.tmp
Filesize
1KB

MD5
944722501042b41e77842acdc82d44e4

SHA1
58e64dadb5aa6e045ef909a691f6141e0f4e378d

SHA256
831cfd0826d59bbc9954f1fe4ecebd9c19e6104a01614a6db8948fa747a0ac2b

SHA512
2141f5d47d5defe9e529f08d0cebff2af6d3e0499c643a89ffb29025cba7b29573a23fb16f1d758e829b4a50a7f7885b2097b67417d8680f03c0795b2bc4f6b6

Download Submit
memory/2108-22-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-1-0x0000000001170000-0x000000000122A000-memory.dmp

Filesize
744KB

Download
memory/2108-2-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-3-0x00000000007D0000-0x00000000007DA000-memory.dmp

Filesize
40KB

Download
memory/2108-4-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

Filesize
4KB

Download
memory/2108-5-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-6-0x0000000005890000-0x0000000005932000-memory.dmp

Filesize
648KB

Download
memory/2108-0-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

Filesize
4KB

Download
memory/2196-15-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2196-19-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2196-21-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2196-17-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2196-12-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2196-14-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2196-13-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2196-16-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download