Malware Analysis Report

2024-11-30 18:47

Sample ID 220521-bzszcsfghn
Target 18590b4c2ee6ef9c9e44396fdeb06ab8530ece6bc2b86be4bd28f666cf1de5f2
SHA256 18590b4c2ee6ef9c9e44396fdeb06ab8530ece6bc2b86be4bd28f666cf1de5f2
Tags
collection spyware stealer cheetahkeylogger keylogger
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

18590b4c2ee6ef9c9e44396fdeb06ab8530ece6bc2b86be4bd28f666cf1de5f2

Threat Level: Known bad

The file 18590b4c2ee6ef9c9e44396fdeb06ab8530ece6bc2b86be4bd28f666cf1de5f2 was found to be: Known bad.

Malicious Activity Summary

collection spyware stealer cheetahkeylogger keylogger

Cheetah Keylogger

Cheetah Keylogger Payload

Executes dropped EXE

Reads data files stored by FTP clients

Loads dropped DLL

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

outlook_win_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-21 01:35

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-21 01:35

Reported

2022-05-21 02:25

Platform

win10v2004-20220414-en

Max time kernel

158s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO2034900.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ifconfig.me N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3684 set thread context of 796 N/A C:\Users\Admin\AppData\Local\Temp\PO2034900.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO2034900.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO2034900.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PO2034900.exe

"C:\Users\Admin\AppData\Local\Temp\PO2034900.exe"

C:\Users\Admin\AppData\Local\Temp\svhost.exe

"C:\Users\Admin\AppData\Local\Temp\svhost.exe"

Network

Country Destination Domain Proto
NL 20.190.160.67:443 tcp
US 52.182.143.208:443 tcp
US 8.8.8.8:53 ifconfig.me udp
US 34.117.59.81:80 ifconfig.me tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
NL 87.248.202.1:80 tcp
US 8.8.8.8:53 mail.sokutuattorneys.co.za udp
ZA 197.221.2.227:587 mail.sokutuattorneys.co.za tcp
NL 20.190.160.136:443 tcp
NL 20.190.160.71:443 tcp
NL 20.190.160.129:443 tcp
NL 20.190.160.75:443 tcp
NL 20.190.160.134:443 tcp

Files

memory/3684-130-0x0000000000AB0000-0x0000000000B0A000-memory.dmp

memory/3684-131-0x0000000005580000-0x000000000561C000-memory.dmp

memory/796-132-0x0000000000000000-mapping.dmp

memory/796-133-0x0000000000400000-0x0000000000422000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

memory/796-136-0x00000000058F0000-0x0000000005E94000-memory.dmp

memory/796-137-0x0000000005670000-0x0000000005702000-memory.dmp

memory/796-138-0x0000000005EA0000-0x0000000006062000-memory.dmp

memory/796-139-0x0000000006520000-0x0000000006586000-memory.dmp

memory/796-140-0x0000000006950000-0x000000000695A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-21 01:35

Reported

2022-05-21 02:24

Platform

win7-20220414-en

Max time kernel

39s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO2034900.exe"

Signatures

Cheetah Keylogger

stealer keylogger cheetahkeylogger

Cheetah Keylogger Payload

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO2034900.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ifconfig.me N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1276 set thread context of 956 N/A C:\Users\Admin\AppData\Local\Temp\PO2034900.exe C:\Users\Admin\AppData\Local\Temp\svhost.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO2034900.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO2034900.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\svhost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PO2034900.exe

"C:\Users\Admin\AppData\Local\Temp\PO2034900.exe"

C:\Users\Admin\AppData\Local\Temp\svhost.exe

"C:\Users\Admin\AppData\Local\Temp\svhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ifconfig.me udp
US 34.117.59.81:80 ifconfig.me tcp
US 8.8.8.8:53 mail.sokutuattorneys.co.za udp
ZA 197.221.2.227:587 mail.sokutuattorneys.co.za tcp

Files

memory/1276-54-0x0000000000F00000-0x0000000000F5A000-memory.dmp

memory/1276-55-0x0000000000500000-0x0000000000526000-memory.dmp

memory/1276-56-0x00000000756E1000-0x00000000756E3000-memory.dmp

\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 9af17c8393f0970ee5136bd3ffa27001
SHA1 4b285b72c1a11285a25f31f2597e090da6bbc049
SHA256 71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512 b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

memory/956-58-0x0000000000400000-0x0000000000422000-memory.dmp

memory/956-59-0x0000000000400000-0x0000000000422000-memory.dmp

memory/956-61-0x0000000000400000-0x0000000000422000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 9af17c8393f0970ee5136bd3ffa27001
SHA1 4b285b72c1a11285a25f31f2597e090da6bbc049
SHA256 71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512 b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

memory/956-63-0x000000000041FE5E-mapping.dmp

memory/956-62-0x0000000000400000-0x0000000000422000-memory.dmp

memory/956-66-0x0000000000400000-0x0000000000422000-memory.dmp

memory/956-68-0x0000000000400000-0x0000000000422000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svhost.exe

MD5 9af17c8393f0970ee5136bd3ffa27001
SHA1 4b285b72c1a11285a25f31f2597e090da6bbc049
SHA256 71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512 b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

memory/956-70-0x00000000001E0000-0x0000000000216000-memory.dmp