Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7 -
submitted
16-08-2020 13:59
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
Purchase Order.exe
-
Size
282KB
-
MD5
b861f4c2cd486258a79a2078c58885e8
-
SHA1
a52c73cecef8c37bcaf95aeeb456580544a6e27c
-
SHA256
e0dd9126e9038ec946d016833bad57afb1d3eb06e453ec8a0bdd60661e6a3da2
-
SHA512
2d51a0096e6c99209bbd020f8523143c1651567296e3123cc4650e9809dc5c5f560fa8b1848d18cd240a53f5ae9fcfbf11bca98eb04d2a678f6d45c682d36371
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
mail.aviner.co.za - Port:
587 - Username:
[email protected] - Password:
NoLimits@
Signatures
-
Cheetah Keylogger
Cheetah is a keylogger and info stealer first seen in March 2020.
-
Cheetah Keylogger Payload 1 IoCs
resource yara_rule behavioral1/memory/776-13-0x0000000000430000-0x0000000000466000-memory.dmp family_cheetahkeylogger -
Executes dropped EXE 1 IoCs
pid Process 776 svhost.exe -
Loads dropped DLL 1 IoCs
pid Process 672 Purchase Order.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ifconfig.me -
Suspicious use of NtSetInformationThreadHideFromDebugger 201 IoCs
pid Process 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 672 set thread context of 776 672 Purchase Order.exe 24 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 svhost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 svhost.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 672 Purchase Order.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe 776 svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 672 Purchase Order.exe Token: SeDebugPrivilege 776 svhost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 672 wrote to memory of 776 672 Purchase Order.exe 24 PID 672 wrote to memory of 776 672 Purchase Order.exe 24 PID 672 wrote to memory of 776 672 Purchase Order.exe 24 PID 672 wrote to memory of 776 672 Purchase Order.exe 24 PID 672 wrote to memory of 776 672 Purchase Order.exe 24 PID 672 wrote to memory of 776 672 Purchase Order.exe 24 PID 672 wrote to memory of 776 672 Purchase Order.exe 24 PID 672 wrote to memory of 776 672 Purchase Order.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:776
-