Analysis Overview
SHA256
18590b4c2ee6ef9c9e44396fdeb06ab8530ece6bc2b86be4bd28f666cf1de5f2
Threat Level: Known bad
The file 18590b4c2ee6ef9c9e44396fdeb06ab8530ece6bc2b86be4bd28f666cf1de5f2 was found to be: Known bad.
Malicious Activity Summary
Cheetah Keylogger
Cheetah Keylogger Payload
Executes dropped EXE
Reads data files stored by FTP clients
Loads dropped DLL
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory
outlook_office_path
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
outlook_win_path
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-21 01:35
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-21 01:35
Reported
2022-05-21 02:25
Platform
win10v2004-20220414-en
Max time kernel
158s
Max time network
161s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ifconfig.me | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3684 set thread context of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3684 wrote to memory of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
| PID 3684 wrote to memory of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
| PID 3684 wrote to memory of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
| PID 3684 wrote to memory of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
| PID 3684 wrote to memory of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
| PID 3684 wrote to memory of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
| PID 3684 wrote to memory of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\PO2034900.exe
"C:\Users\Admin\AppData\Local\Temp\PO2034900.exe"
C:\Users\Admin\AppData\Local\Temp\svhost.exe
"C:\Users\Admin\AppData\Local\Temp\svhost.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 20.190.160.67:443 | tcp | |
| US | 52.182.143.208:443 | tcp | |
| US | 8.8.8.8:53 | ifconfig.me | udp |
| US | 34.117.59.81:80 | ifconfig.me | tcp |
| NL | 104.110.191.140:80 | tcp | |
| NL | 104.110.191.140:80 | tcp | |
| NL | 87.248.202.1:80 | tcp | |
| US | 8.8.8.8:53 | mail.sokutuattorneys.co.za | udp |
| ZA | 197.221.2.227:587 | mail.sokutuattorneys.co.za | tcp |
| NL | 20.190.160.136:443 | tcp | |
| NL | 20.190.160.71:443 | tcp | |
| NL | 20.190.160.129:443 | tcp | |
| NL | 20.190.160.75:443 | tcp | |
| NL | 20.190.160.134:443 | tcp |
Files
memory/3684-130-0x0000000000AB0000-0x0000000000B0A000-memory.dmp
memory/3684-131-0x0000000005580000-0x000000000561C000-memory.dmp
memory/796-132-0x0000000000000000-mapping.dmp
memory/796-133-0x0000000000400000-0x0000000000422000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\svhost.exe
| MD5 | 8fdf47e0ff70c40ed3a17014aeea4232 |
| SHA1 | e6256a0159688f0560b015da4d967f41cbf8c9bd |
| SHA256 | ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82 |
| SHA512 | bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be |
C:\Users\Admin\AppData\Local\Temp\svhost.exe
| MD5 | 8fdf47e0ff70c40ed3a17014aeea4232 |
| SHA1 | e6256a0159688f0560b015da4d967f41cbf8c9bd |
| SHA256 | ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82 |
| SHA512 | bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be |
memory/796-136-0x00000000058F0000-0x0000000005E94000-memory.dmp
memory/796-137-0x0000000005670000-0x0000000005702000-memory.dmp
memory/796-138-0x0000000005EA0000-0x0000000006062000-memory.dmp
memory/796-139-0x0000000006520000-0x0000000006586000-memory.dmp
memory/796-140-0x0000000006950000-0x000000000695A000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-21 01:35
Reported
2022-05-21 02:24
Platform
win7-20220414-en
Max time kernel
39s
Max time network
135s
Command Line
Signatures
Cheetah Keylogger
Cheetah Keylogger Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | N/A |
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ifconfig.me | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1276 set thread context of 956 | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | C:\Users\Admin\AppData\Local\Temp\svhost.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\PO2034900.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\svhost.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\PO2034900.exe
"C:\Users\Admin\AppData\Local\Temp\PO2034900.exe"
C:\Users\Admin\AppData\Local\Temp\svhost.exe
"C:\Users\Admin\AppData\Local\Temp\svhost.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ifconfig.me | udp |
| US | 34.117.59.81:80 | ifconfig.me | tcp |
| US | 8.8.8.8:53 | mail.sokutuattorneys.co.za | udp |
| ZA | 197.221.2.227:587 | mail.sokutuattorneys.co.za | tcp |
Files
memory/1276-54-0x0000000000F00000-0x0000000000F5A000-memory.dmp
memory/1276-55-0x0000000000500000-0x0000000000526000-memory.dmp
memory/1276-56-0x00000000756E1000-0x00000000756E3000-memory.dmp
\Users\Admin\AppData\Local\Temp\svhost.exe
| MD5 | 9af17c8393f0970ee5136bd3ffa27001 |
| SHA1 | 4b285b72c1a11285a25f31f2597e090da6bbc049 |
| SHA256 | 71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019 |
| SHA512 | b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3 |
memory/956-58-0x0000000000400000-0x0000000000422000-memory.dmp
memory/956-59-0x0000000000400000-0x0000000000422000-memory.dmp
memory/956-61-0x0000000000400000-0x0000000000422000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\svhost.exe
| MD5 | 9af17c8393f0970ee5136bd3ffa27001 |
| SHA1 | 4b285b72c1a11285a25f31f2597e090da6bbc049 |
| SHA256 | 71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019 |
| SHA512 | b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3 |
memory/956-63-0x000000000041FE5E-mapping.dmp
memory/956-62-0x0000000000400000-0x0000000000422000-memory.dmp
memory/956-66-0x0000000000400000-0x0000000000422000-memory.dmp
memory/956-68-0x0000000000400000-0x0000000000422000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\svhost.exe
| MD5 | 9af17c8393f0970ee5136bd3ffa27001 |
| SHA1 | 4b285b72c1a11285a25f31f2597e090da6bbc049 |
| SHA256 | 71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019 |
| SHA512 | b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3 |
memory/956-70-0x00000000001E0000-0x0000000000216000-memory.dmp