404keylogger | ca231822ad66e6043bf668cdb4dc32ed0b1d3ca08072ddfe40b8dd822bfca7b4

General

Target
QUOTATION REQUEST.exe
Size 778KB
Sample220520-rhmc9afga6
SHA256 c2dc84d69a583c5a9f37109f1c2066af3eca496a1aabb2589c5918a1ca3cb1d7
MD5 015e37c9dcb9a83bb7045aa470a7ec4c
SHA1 5aadda4277223ab858902db9c27fa1167518e968
SHA512 6e6a512e045c5540fcf4ec9133c43ed18c873d6c3e64f268f29e99b9020893cb3ad532476c660f68b05ba14698e0e17f3c130b3cb2b7897ac325b6343f63d11b
MD5 SHA1 SHA512

Score

10^/10

404keylogger collection keylogger spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
eJkG%KP9

Signatures

404 Keylogger
Information stealer and keylogger first seen in 2019.
stealer keylogger 404keylogger

404 Keylogger Main Executable 2 IoCs

resource	yara_rule
behavioral2/memory/2064-131-0x00000000008E0000-0x0000000000902000-memory.dmp	family_404keylogger
behavioral2/memory/2064-133-0x00000000008E0000-0x0000000000902000-memory.dmp	family_404keylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTATION REQUEST.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTATION REQUEST.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTATION REQUEST.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 2064	4052	QUOTATION REQUEST.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	2064	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4052	QUOTATION REQUEST.exe
4052	QUOTATION REQUEST.exe
2064	QUOTATION REQUEST.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4052	QUOTATION REQUEST.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2064	QUOTATION REQUEST.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	QUOTATION REQUEST.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2064	4052	QUOTATION REQUEST.exe	80
PID 4052 wrote to memory of 2064	4052	QUOTATION REQUEST.exe	80
PID 4052 wrote to memory of 2064	4052	QUOTATION REQUEST.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTATION REQUEST.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	QUOTATION REQUEST.exe

C:\Users\Admin\AppData\Local\Temp\QUOTATION REQUEST.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION REQUEST.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\QUOTATION REQUEST.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION REQUEST.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 2224
    3⤵
    - Program crash
    PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2064 -ip 2064
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-131-0x00000000008E0000-0x0000000000902000-memory.dmp

Download

memory/2064-133-0x00000000008E0000-0x0000000000902000-memory.dmp

Download

memory/2064-134-0x0000000004A00000-0x0000000004FA4000-memory.dmp

Download

memory/2064-135-0x00000000048F0000-0x000000000498C000-memory.dmp

Download

memory/2064-136-0x0000000005B30000-0x0000000005B96000-memory.dmp

Download

memory/2064-137-0x0000000006030000-0x00000000061F2000-memory.dmp

Download

memory/2064-138-0x0000000006430000-0x00000000064C2000-memory.dmp

Download

memory/4052-132-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads