6 minhigh
Beware of Phishing Emails Disguised as Project Proposals
A phishing campaign distributing SnakeKeylogger is using emails disguised as project proposals to deliver JavaScript malware inside compressed attachments. Upon execution, the JS malware invokes PowerShell to decrypt and load an encrypted SnakeKeylogger payload in memory without writing to disk. The infostealer then harvests browser data, system information, and keylogging data, exfiltrating it via SMTP or Telegram to attacker-controlled infrastructure.
Sens:▲ 24hConf:medium
Showing defanged values
- domainmail[.]Trimnt[.]comSMTP mail server used as SnakeKeylogger C2 for data exfiltration
- emailkeishstanford5[@]gmail[.]comGmail address used as exfiltration destination for stolen data
- emailnova3[@]mnt[.]comEmail account ID used for SMTP authentication to the C2 mail server
- md50cbfcc3573399368a2a9abcfa42af134MD5 hash of the malicious JavaScript malware file delivered via phishing attachment
Detection / Hunteropenrouter
What Happened
Attackers are sending fake project proposal emails that trick recipients into downloading and opening a compressed file. Inside the file is a malicious JavaScript program that, when opened, secretly runs a tool called SnakeKeylogger on the victim's computer. This tool steals sensitive information such as saved browser passwords, system details, and everything typed on the keyboard, then sends the stolen data to the attackers via email or messaging services. Anyone who receives unexpected project proposal emails with attachments should be cautious. Organizations should remind employees not to open suspicious attachments and to verify sender addresses before interacting with email content.
Key Takeaways
- Phishing emails disguised as project proposals deliver JavaScript malware inside compressed file attachments.
- The JavaScript malware uses PowerShell to decrypt and execute an encrypted SnakeKeylogger payload entirely in memory, avoiding disk-based detection.
- SnakeKeylogger collects browser data, system information, and keylogging data, exfiltrating it via SMTP or Telegram.
- C2 infrastructure includes a mail server (mail.Trimnt.com) and a Gmail address for data exfiltration.
Affected Systems
- Windows systems targeted via JavaScript and PowerShell execution
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing email disguised as a project proposal prompts recipient to download a compressed file attachment.
- Execution: User decompresses the archive and executes the disguised JavaScript malware file.
- Defense Evasion: JavaScript invokes PowerShell with an encrypted SnakeKeylogger payload as an argument; PowerShell decrypts and executes the payload in memory without writing to disk.
- Collection: SnakeKeylogger harvests browser data, system information, and keylogging data from the infected system.
- Exfiltration: Stolen data is transmitted externally via SMTP to attacker-controlled mail server or via Telegram.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. An MD5 hash and C2 infrastructure details are available for IOC-based detection.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The in-memory PowerShell execution from a JavaScript host process (e.g., wscript.exe spawning powershell.exe) is a visible behavioral pattern via EDR process telemetry. However, the fileless nature of the SnakeKeylogger payload may reduce visibility into post-execution activity. |
| Network Visibility | Medium | SMTP exfiltration to mail.Trimnt.com and any Telegram API traffic could be detected via network monitoring, but SMTP on standard ports may blend with legitimate email traffic. |
| Detection Difficulty | Moderate | The wscript.exe to powershell.exe execution chain is a well-known behavioral pattern, but the encrypted in-memory payload and use of legitimate SMTP/Telegram channels for exfiltration add complexity to detection. |
Required Log Sources
- Process creation logs (Sysmon Event ID 1 / EDR)
- Network connection logs
- Email gateway logs
- PowerShell script block logging (Event ID 4104)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for JavaScript host processes (e.g., wscript.exe) spawning PowerShell with encoded command arguments, which may indicate in-memory payload delivery. | Process creation events with command-line arguments, parent-child process relationships | Execution | Low — legitimate administrative scripts rarely chain wscript.exe directly to PowerShell with encoded commands. |
| Consider hunting for outbound SMTP connections to non-corporate mail servers, especially from endpoints that do not normally send email directly. | Network connection logs, firewall logs, proxy logs | Exfiltration | Medium — legitimate applications or mail clients may initiate SMTP connections to external servers. |
| Consider hunting for processes accessing browser credential stores and keylogging-related API calls shortly after PowerShell execution from a scripting host. | EDR file access events, API hooking telemetry, Sysmon file access events | Collection | Medium — legitimate browsers and security tools may access credential stores during normal operation. |
Control Gaps
- Traditional signature-based AV may miss the fileless in-memory execution of the SnakeKeylogger payload.
- Network-based detection may not flag SMTP exfiltration if it uses standard ports and appears as legitimate email traffic.
- Email gateway filtering may not block compressed archives containing JavaScript files depending on policy configuration.
Key Behavioral Indicators
- wscript.exe spawning powershell.exe with encoded command arguments
- PowerShell process with no file-based payload on disk (in-memory execution only)
- Outbound SMTP connections to mail.Trimnt.com from non-mail-server endpoints
- Processes accessing browser credential databases shortly after script-host-spawned PowerShell execution
False Positive Assessment
Low — the wscript.exe to powershell.exe execution chain with encoded arguments is a strong behavioral indicator, and the identified C2 infrastructure is specific to this campaign.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified C2 domain (mail.Trimnt.com) and exfiltration email address ([email protected]) on email gateways and network firewalls.
- Consider searching endpoint telemetry for the MD5 hash 0cbfcc3573399368a2a9abcfa42af134 and any instances of wscript.exe spawning powershell.exe with encoded arguments.
- If your email gateway supports it, consider quarantining or blocking compressed attachments containing JavaScript files from external senders.
Infrastructure Hardening
- Evaluate whether your email filtering policy can block or sandbox archive files containing executable script formats (.js, .vbs, .ps1).
- Consider implementing network rules to restrict direct outbound SMTP connections from endpoints that do not require email-sending capability.
- If applicable, consider restricting PowerShell execution policies and enabling script block logging (Event ID 4104) for enhanced visibility.
User Protection
- Consider deploying EDR rules that alert on scripting host processes (wscript.exe, cscript.exe) spawning PowerShell with encoded commands.
- Evaluate whether browser credential theft protection features are enabled in your endpoint security solution.
Security Awareness
- Consider reminding employees to verify sender email domains before opening attachments, especially for unexpected project proposals.
- Consider incorporating this phishing scenario into existing security awareness training, emphasizing the risk of compressed files containing JavaScript files.
- Encourage users to report suspicious emails to security teams rather than opening attachments, even if the sender appears legitimate.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Exfiltration
Additional IOCs
- Command Lines:
- Purpose: JavaScript malware invokes PowerShell to decrypt and execute encrypted SnakeKeylogger payload in memory | Tools:
powershell.exe,wscript.exe| Stage: Execution |powershell.exe -enc
- Purpose: JavaScript malware invokes PowerShell to decrypt and execute encrypted SnakeKeylogger payload in memory | Tools: