Analysis
-
max time kernel
68s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:41
Static task
static1
Behavioral task
behavioral1
Sample
Bank Details.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Bank Details.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Bank Details.exe
-
Size
406KB
-
MD5
602837306612ca096d4729269b4080d3
-
SHA1
cb8eccbada88f67becdb128bdcd050104cab892f
-
SHA256
5165df1ccd40fd8cfe1e6646614a97210c3d0890cfa38dd4896fcbb9da88bed1
-
SHA512
2060d8393abb4be89309d8d00494fcd255924eab4ad085e8d86e26f022d2ca42a8ee61ba0f2dbb6167a4ee25fb1d0a447b96f35babd4e7a657086e9836268573
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
mail.aviner.co.za - Port:
587 - Username:
[email protected] - Password:
NoLimits@
Signatures
-
Cheetah Keylogger
Cheetah is a keylogger and info stealer first seen in March 2020.
-
Cheetah Keylogger Payload 1 IoCs
resource yara_rule behavioral2/memory/4084-16-0x0000000004820000-0x0000000004851000-memory.dmp family_cheetahkeylogger -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ifconfig.me -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4760 set thread context of 4084 4760 Bank Details.exe 79 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4760 Bank Details.exe 4760 Bank Details.exe 4760 Bank Details.exe 4084 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4760 Bank Details.exe Token: SeDebugPrivilege 4084 InstallUtil.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4084 4760 Bank Details.exe 79 PID 4760 wrote to memory of 4084 4760 Bank Details.exe 79 PID 4760 wrote to memory of 4084 4760 Bank Details.exe 79 PID 4760 wrote to memory of 4084 4760 Bank Details.exe 79 PID 4760 wrote to memory of 4084 4760 Bank Details.exe 79 PID 4760 wrote to memory of 4084 4760 Bank Details.exe 79 PID 4760 wrote to memory of 4084 4760 Bank Details.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Details.exe"C:\Users\Admin\AppData\Local\Temp\Bank Details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084
-