cheetahkeylogger | 5165df1ccd40fd8cfe1e6646614a97210c3d0890cfa38dd4896fcbb9da88bed1

General

Target

Bank Details.exe
Size

406KB
MD5

602837306612ca096d4729269b4080d3
SHA1

cb8eccbada88f67becdb128bdcd050104cab892f
SHA256

5165df1ccd40fd8cfe1e6646614a97210c3d0890cfa38dd4896fcbb9da88bed1
SHA512

2060d8393abb4be89309d8d00494fcd255924eab4ad085e8d86e26f022d2ca42a8ee61ba0f2dbb6167a4ee25fb1d0a447b96f35babd4e7a657086e9836268573

Score

10^/10

Credentials

Cheetah Keylogger
Cheetah is a keylogger and info stealer first seen in March 2020.
stealer keylogger cheetahkeylogger

Cheetah Keylogger Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/564-14-0x00000000005C0000-0x00000000005F1000-memory.dmp	family_cheetahkeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ifconfig.me
Suspicious use of SetThreadContext 1 IoCs

Processes:

Bank Details.exe

description pid process target process

PID 1880 set thread context of 564 1880 Bank Details.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Bank Details.exeInstallUtil.exe

pid process

1880 Bank Details.exe
1880 Bank Details.exe
1880 Bank Details.exe
564 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Bank Details.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 1880 Bank Details.exe
Token: SeDebugPrivilege 564 InstallUtil.exe

flow	ioc
5	ifconfig.me

description	pid	process	target process
PID 1880 set thread context of 564	1880	Bank Details.exe	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1880	Bank Details.exe
Token: SeDebugPrivilege	564	InstallUtil.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Bank Details.exe

description	pid	process	target process
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe
PID 1880 wrote to memory of 564	1880	Bank Details.exe	InstallUtil.exe

memory/564-7-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/564-8-0x000000000041FEBE-mapping.dmp

Download
memory/564-9-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/564-10-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/564-11-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/564-14-0x00000000005C0000-0x00000000005F1000-memory.dmp

Filesize
196KB

Download
memory/1880-0-0x00000000743D0000-0x0000000074ABE000-memory.dmp

Filesize
6.9MB

Download
memory/1880-1-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1880-3-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/1880-4-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/1880-5-0x0000000000550000-0x0000000000552000-memory.dmp

Filesize
8KB

Download
memory/1880-6-0x0000000000950000-0x0000000000955000-memory.dmp

Filesize
20KB

Download