404keylogger | 1ac0d1fe05ce9e035856dc6634be2e963e9a8f8d7973ba9df6dcfe3f34460bdd

General

Target
Invoice 286552.exe
Size 321KB
Sample220205-w812jseca5
SHA256 6f5d5200fd05256b6378abc61632c7dd76c8a4bf24571b6ee663e22d663730a0
MD5 db0c307ed26ca12e4b5a3c3b5eaca27a
SHA1 849a06830c500998bbd5fb1e9d6f6f1d3e23316e
SHA512 9a3f05d866668ab35c092a3bcc7d9c3a7702d4403539ff682b2515454818548ef0172919c411745c74bf6253be294f0e7cfea149a56ea879017fca091c4871a5
MD5 SHA1 SHA512

Score

10^/10

404keylogger collection keylogger spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.privateemail.com
Port
587
Username
[email protected]
Password
Okeamu123

Signatures

404 Keylogger
Information stealer and keylogger first seen in 2019.
stealer keylogger 404keylogger

404 Keylogger Main Executable 1 IoCs

resource	yara_rule
behavioral2/memory/3096-137-0x0000000000400000-0x0000000000422000-memory.dmp	family_404keylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	Invoice 286552.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Invoice 286552.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Invoice 286552.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Invoice 286552.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3148 set thread context of 3096	3148	Invoice 286552.exe	86

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3148	Invoice 286552.exe
3148	Invoice 286552.exe
3096	Invoice 286552.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	Invoice 286552.exe
Token: SeDebugPrivilege	3096	Invoice 286552.exe
Token: SeShutdownPrivilege	4852	svchost.exe
Token: SeCreatePagefilePrivilege	4852	svchost.exe
Token: SeShutdownPrivilege	4852	svchost.exe
Token: SeCreatePagefilePrivilege	4852	svchost.exe
Token: SeShutdownPrivilege	4852	svchost.exe
Token: SeCreatePagefilePrivilege	4852	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	Invoice 286552.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 2488	3148	Invoice 286552.exe	83
PID 3148 wrote to memory of 2488	3148	Invoice 286552.exe	83
PID 3148 wrote to memory of 2488	3148	Invoice 286552.exe	83
PID 3148 wrote to memory of 3060	3148	Invoice 286552.exe	85
PID 3148 wrote to memory of 3060	3148	Invoice 286552.exe	85
PID 3148 wrote to memory of 3060	3148	Invoice 286552.exe	85
PID 3148 wrote to memory of 3096	3148	Invoice 286552.exe	86
PID 3148 wrote to memory of 3096	3148	Invoice 286552.exe	86
PID 3148 wrote to memory of 3096	3148	Invoice 286552.exe	86
PID 3148 wrote to memory of 3096	3148	Invoice 286552.exe	86
PID 3148 wrote to memory of 3096	3148	Invoice 286552.exe	86
PID 3148 wrote to memory of 3096	3148	Invoice 286552.exe	86
PID 3148 wrote to memory of 3096	3148	Invoice 286552.exe	86
PID 3148 wrote to memory of 3096	3148	Invoice 286552.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Invoice 286552.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Invoice 286552.exe

C:\Users\Admin\AppData\Local\Temp\Invoice 286552.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice 286552.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QfsWgvANVJrOqG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp83E3.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\Invoice 286552.exe
  "{path}"
  2⤵
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\Invoice 286552.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:3096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4852