cheetahkeylogger | c4321f8a7c6225614746430b2f64998ef2bb9f4dcc94d8c5226c70c35eeb9039

General

Target

Payment Notification.exe
Size

381KB
MD5

673a1dd42a4ce1a314a1db4dcbf09a81
SHA1

2fdb26d92e25c38c6300123278cbcea3be6a0ecc
SHA256

684aa4d9c333d3ea5db101d239673a76f22e06ae5237ae24b00e43c55cb3b3ae
SHA512

9be66fa1b076700972797c273bce0d14594fc3cc58728e0ca5552138c9dac04152470ae70d44a7c9c6dbf2b672143085134e14a9f7c6c54cce88aa2715ad6201

Score

10^/10

cheetahkeylogger agilenet collection keylogger stealer

Malware Config

Signatures

Cheetah Keylogger
Cheetah is a keylogger and info stealer first seen in March 2020.
stealer keylogger cheetahkeylogger

Cheetah Keylogger Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/880-70-0x0000000000200000-0x0000000000236000-memory.dmp	family_cheetahkeylogger

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1392-55-0x0000000000530000-0x0000000000546000-memory.dmp	agile_net

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	ifconfig.me

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment Notification.exe

description	pid	Process	procid_target
PID 1392 set thread context of 880	1392	Payment Notification.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Payment Notification.exeInstallUtil.exe

pid	Process
1392	Payment Notification.exe
1392	Payment Notification.exe
1392	Payment Notification.exe
880	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Payment Notification.exeInstallUtil.exe

description	pid	Process
Token: SeDebugPrivilege	1392	Payment Notification.exe
Token: SeDebugPrivilege	880	InstallUtil.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Payment Notification.exe

description	pid	Process	procid_target
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28
PID 1392 wrote to memory of 880	1392	Payment Notification.exe	28

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-64-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/880-63-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/880-70-0x0000000000200000-0x0000000000236000-memory.dmp

Filesize
216KB

Download
memory/880-69-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/880-67-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/880-61-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/880-65-0x000000000041FE3E-mapping.dmp

Download
memory/880-60-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1392-55-0x0000000000530000-0x0000000000546000-memory.dmp

Filesize
88KB

Download
memory/1392-54-0x0000000000070000-0x00000000000D6000-memory.dmp

Filesize
408KB

Download
memory/1392-59-0x0000000001DC0000-0x0000000001DCA000-memory.dmp

Filesize
40KB

Download
memory/1392-58-0x0000000001DB0000-0x0000000001DB8000-memory.dmp

Filesize
32KB

Download
memory/1392-57-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/1392-56-0x0000000075951000-0x0000000075953000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads