404keylogger | ae6ad2297366fb5194e553992732f0a5740de2c5fe4b7be56fd2e1a52cb915c4

General

Target
orden de compra.exe
Size 834KB
Sample210219-9pc2yl24ts
SHA256 ae6ad2297366fb5194e553992732f0a5740de2c5fe4b7be56fd2e1a52cb915c4
MD5 82ce2f8364d3dca44267a6b049b4a070
SHA1 091df496943099bfe2f03c5a0d53789ed89f094e
SHA512 3ee34812e076f7b835ddc99fd79f5585a7cb6471e632a9ab17dc0d41c701565c75bb0ee96a13cb9e8e9b67a4c3e3dcb29066df0878b8c8de5e403102681cc9e4
MD5 SHA1 SHA512

Score

10^/10

404keylogger keylogger spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.maccinox.com
Port
587
Username
[email protected]
Password
peru2016

Signatures

404 Keylogger
Information stealer and keylogger first seen in 2019.
stealer keylogger 404keylogger

404 Keylogger Main Executable 3 IoCs

resource	yara_rule
behavioral1/memory/1724-8-0x0000000000400000-0x0000000000422000-memory.dmp	family_404keylogger
behavioral1/memory/1724-9-0x000000000041CB9E-mapping.dmp	family_404keylogger
behavioral1/memory/1724-11-0x0000000000400000-0x0000000000422000-memory.dmp	family_404keylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 1724	1832	orden de compra.exe	30

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	orden de compra.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	orden de compra.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	orden de compra.exe
1724	orden de compra.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	orden de compra.exe
Token: SeDebugPrivilege	1724	orden de compra.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1724	orden de compra.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 996	1832	orden de compra.exe	29
PID 1832 wrote to memory of 996	1832	orden de compra.exe	29
PID 1832 wrote to memory of 996	1832	orden de compra.exe	29
PID 1832 wrote to memory of 996	1832	orden de compra.exe	29
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30
PID 1832 wrote to memory of 1724	1832	orden de compra.exe	30

C:\Users\Admin\AppData\Local\Temp\orden de compra.exe
"C:\Users\Admin\AppData\Local\Temp\orden de compra.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\orden de compra.exe
  "C:\Users\Admin\AppData\Local\Temp\orden de compra.exe"
  2⤵
  PID:996
- C:\Users\Admin\AppData\Local\Temp\orden de compra.exe
  "C:\Users\Admin\AppData\Local\Temp\orden de compra.exe"
  2⤵
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-8-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1724-10-0x00000000749E0000-0x00000000750CE000-memory.dmp

Download

memory/1724-11-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1724-13-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/1832-2-0x00000000749E0000-0x00000000750CE000-memory.dmp

Download

memory/1832-3-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/1832-5-0x0000000000490000-0x0000000000494000-memory.dmp

Download

memory/1832-6-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/1832-7-0x0000000000AA0000-0x0000000000AE3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads