snakekeylogger | 75f2d758f27b27982c84af9f9ad2677e005a72a385e48627dfa13341a4273606

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe
Size

725KB
MD5

132eb1a40c403bc96986024b3de63dbb
SHA1

52996e976b37b7ac2a53be90864b44e7d02c1974
SHA256

75f2d758f27b27982c84af9f9ad2677e005a72a385e48627dfa13341a4273606
SHA512

2757b1baba6e0d3253e7c2aca14020b739d368684f475b72ff4d470559f3626972f522ca30a7b30379d2b78df646b0f8299615758491b391b78b819be92f95e8
SSDEEP

12288:M9yCkuvgld21fNlRULtFkcmPMUHiMySw3Tznmj0ztF9CoTYUVuwwVTMsMf:M5dvTItFk7fiEjU6WYQultTE

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: ftp
Host:
ftp://bitrix370.timeweb.ru/
Port:
21
Username:
cn94754
Password:
c2eitfpidhgS

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

38 checkip.dyndns.org
40 freegeoip.app
41 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe

description pid process target process

PID 3180 set thread context of 1128 3180 132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1156 1128 WerFault.exe MSBuild.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3520 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

MSBuild.exe

pid process

1128 MSBuild.exe
1128 MSBuild.exe
1128 MSBuild.exe
1128 MSBuild.exe
1128 MSBuild.exe
1128 MSBuild.exe
1128 MSBuild.exe
1128 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 1128 MSBuild.exe

flow	ioc
38	checkip.dyndns.org
40	freegeoip.app
41	freegeoip.app

description	pid	process	target process
PID 3180 set thread context of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe

pid	pid_target	process	target process
1156	1128	WerFault.exe	MSBuild.exe

pid	process
3520	schtasks.exe

pid	process
1128	MSBuild.exe
1128	MSBuild.exe
1128	MSBuild.exe
1128	MSBuild.exe
1128	MSBuild.exe
1128	MSBuild.exe
1128	MSBuild.exe
1128	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1128	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe

description	pid	process	target process
PID 3180 wrote to memory of 3520	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	schtasks.exe
PID 3180 wrote to memory of 3520	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	schtasks.exe
PID 3180 wrote to memory of 3520	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	schtasks.exe
PID 3180 wrote to memory of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 3180 wrote to memory of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 3180 wrote to memory of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 3180 wrote to memory of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 3180 wrote to memory of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 3180 wrote to memory of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 3180 wrote to memory of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe
PID 3180 wrote to memory of 1128	3180	132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe	MSBuild.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\132eb1a40c403bc96986024b3de63dbb_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkoaYBUIwbGl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6BC5.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 1748
3⤵
- Program crash
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1128 -ip 1128
1⤵
PID:3780

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6BC5.tmp
Filesize
1KB

MD5
a4c18aa270c34cc4b90324cacda05e01

SHA1
94af3a699872474a047e130e28ca7d23c5603d10

SHA256
183632dd86d46e96982c872ce4448422ab2d3a475b036888a82d159f51b4d538

SHA512
cf8529d328c17da1ee8852ca3d6b11f2cb4218c877c6b4da93a1c0cde4ebd53b1fc4943bdc686b567d05b2c6c4d8c1b7c7d0070eca58af08eb57314b25a7fcb5

Download Submit
memory/1128-24-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1128-23-0x00000000062E0000-0x00000000064A2000-memory.dmp

Filesize
1.8MB

Download
memory/1128-22-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1128-21-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1128-18-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3180-10-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/3180-6-0x0000000004F00000-0x0000000004F56000-memory.dmp

Filesize
344KB

Download
memory/3180-8-0x0000000005870000-0x0000000005BC4000-memory.dmp

Filesize
3.3MB

Download
memory/3180-9-0x0000000005130000-0x000000000513A000-memory.dmp

Filesize
40KB

Download
memory/3180-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/3180-11-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/3180-12-0x0000000005E10000-0x0000000005EB2000-memory.dmp

Filesize
648KB

Download
memory/3180-7-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/3180-5-0x0000000004C60000-0x0000000004C6A000-memory.dmp

Filesize
40KB

Download
memory/3180-20-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/3180-4-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Filesize
584KB

Download
memory/3180-3-0x00000000052C0000-0x0000000005864000-memory.dmp

Filesize
5.6MB

Download
memory/3180-2-0x0000000004C70000-0x0000000004D0C000-memory.dmp

Filesize
624KB

Download
memory/3180-1-0x00000000001E0000-0x000000000029A000-memory.dmp

Filesize
744KB

Download