Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
16-08-2020 13:59
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
Purchase Order.exe
-
Size
282KB
-
MD5
b861f4c2cd486258a79a2078c58885e8
-
SHA1
a52c73cecef8c37bcaf95aeeb456580544a6e27c
-
SHA256
e0dd9126e9038ec946d016833bad57afb1d3eb06e453ec8a0bdd60661e6a3da2
-
SHA512
2d51a0096e6c99209bbd020f8523143c1651567296e3123cc4650e9809dc5c5f560fa8b1848d18cd240a53f5ae9fcfbf11bca98eb04d2a678f6d45c682d36371
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
mail.aviner.co.za - Port:
587 - Username:
[email protected] - Password:
NoLimits@
Signatures
-
Cheetah Keylogger
Cheetah is a keylogger and info stealer first seen in March 2020.
-
Cheetah Keylogger Payload 1 IoCs
resource yara_rule behavioral2/memory/628-11-0x0000000002C80000-0x0000000002CB6000-memory.dmp family_cheetahkeylogger -
Executes dropped EXE 1 IoCs
pid Process 628 svhost.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ifconfig.me -
Suspicious use of NtSetInformationThreadHideFromDebugger 188 IoCs
pid Process 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2584 set thread context of 628 2584 Purchase Order.exe 66 -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2584 Purchase Order.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe 628 svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2584 Purchase Order.exe Token: SeDebugPrivilege 628 svhost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2584 wrote to memory of 628 2584 Purchase Order.exe 66 PID 2584 wrote to memory of 628 2584 Purchase Order.exe 66 PID 2584 wrote to memory of 628 2584 Purchase Order.exe 66 PID 2584 wrote to memory of 628 2584 Purchase Order.exe 66 PID 2584 wrote to memory of 628 2584 Purchase Order.exe 66 PID 2584 wrote to memory of 628 2584 Purchase Order.exe 66 PID 2584 wrote to memory of 628 2584 Purchase Order.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628
-