Analysis

  • max time kernel
    39s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 01:35

General

  • Target

    PO2034900.exe

  • Size

    336KB

  • MD5

    fa5a44cc3ffc8fcacdf9ea7251ae2b85

  • SHA1

    377db42b217e4f6f99885afe1e165c19c3b606a5

  • SHA256

    7ea6bd01e613bd93a63711630128ebd9e4f51c411db7d87c62031d06d02127cb

  • SHA512

    3173cfdb0a1fa4651c5c24e75cec363bc1c3c78853eb7cd83af3ac9f2935f77d7e2ee6c22e2d153553bdad567e71c50cd550f01490a1f122ddfd37ce990c1f5a

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.sokutuattorneys.co.za
  • Port:
    587
  • Username:
    admin@sokutuattorneys.co.za
  • Password:
    Qs@9711?

Signatures

  • Cheetah Keylogger

    Cheetah is a keylogger and info stealer first seen in March 2020.

  • Cheetah Keylogger Payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO2034900.exe
    "C:\Users\Admin\AppData\Local\Temp\PO2034900.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:956

Network

  • flag-us
    DNS
    ifconfig.me
    svhost.exe
    Remote address:
    8.8.8.8:53
    Request
    ifconfig.me
    IN A
    Response
    ifconfig.me
    IN A
    34.117.59.81
  • flag-us
    GET
    http://ifconfig.me/ip
    svhost.exe
    Remote address:
    34.117.59.81:80
    Request
    GET /ip HTTP/1.1
    Host: ifconfig.me
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    access-control-allow-origin: *
    content-type: text/plain; charset=utf-8
    content-length: 12
    date: Sat, 21 May 2022 02:22:55 GMT
    x-envoy-upstream-service-time: 1
    strict-transport-security: max-age=300; includeSubDomains
    Via: 1.1 google
  • flag-us
    DNS
    mail.sokutuattorneys.co.za
    svhost.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.sokutuattorneys.co.za
    IN A
    Response
    mail.sokutuattorneys.co.za
    IN A
    197.221.2.227
  • 34.117.59.81:80
    http://ifconfig.me/ip
    http
    svhost.exe
    345 B
    754 B
    6
    5

    HTTP Request

    GET http://ifconfig.me/ip

    HTTP Response

    200
  • 197.221.2.227:587
    mail.sokutuattorneys.co.za
    smtp
    svhost.exe
    515 B
    772 B
    9
    9
  • 8.8.8.8:53
    ifconfig.me
    dns
    svhost.exe
    57 B
    73 B
    1
    1

    DNS Request

    ifconfig.me

    DNS Response

    34.117.59.81

  • 8.8.8.8:53
    mail.sokutuattorneys.co.za
    dns
    svhost.exe
    72 B
    88 B
    1
    1

    DNS Request

    mail.sokutuattorneys.co.za

    DNS Response

    197.221.2.227

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe

    Filesize

    255KB

    MD5

    9af17c8393f0970ee5136bd3ffa27001

    SHA1

    4b285b72c1a11285a25f31f2597e090da6bbc049

    SHA256

    71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

    SHA512

    b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe

    Filesize

    255KB

    MD5

    9af17c8393f0970ee5136bd3ffa27001

    SHA1

    4b285b72c1a11285a25f31f2597e090da6bbc049

    SHA256

    71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

    SHA512

    b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

  • \Users\Admin\AppData\Local\Temp\svhost.exe

    Filesize

    255KB

    MD5

    9af17c8393f0970ee5136bd3ffa27001

    SHA1

    4b285b72c1a11285a25f31f2597e090da6bbc049

    SHA256

    71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

    SHA512

    b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

  • memory/956-61-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/956-58-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/956-59-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/956-62-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/956-66-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/956-68-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/956-70-0x00000000001E0000-0x0000000000216000-memory.dmp

    Filesize

    216KB

  • memory/1276-54-0x0000000000F00000-0x0000000000F5A000-memory.dmp

    Filesize

    360KB

  • memory/1276-56-0x00000000756E1000-0x00000000756E3000-memory.dmp

    Filesize

    8KB

  • memory/1276-55-0x0000000000500000-0x0000000000526000-memory.dmp

    Filesize

    152KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.