Overview

overview

10

Static

static

5

6f03ff2d34...4f.exe

windows7_x64

10

6f03ff2d34...4f.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    170s
  • max time network
    175s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-06-2022 05:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f03ff2d346e59f0e9d9e51569b08fba6c610e7c82fd92719866124bd512054f.exe

  • Size

    1.0MB

  • MD5

    4b94597bc7d13ead3ba618bd7bc222f9

  • SHA1

    d25fdd088c5bcacb93056821a52502b47b03e4e3

  • SHA256

    6f03ff2d346e59f0e9d9e51569b08fba6c610e7c82fd92719866124bd512054f

  • SHA512

    6c638efba643a013793dfa0b9b1700d7181a1b47c11796f6bb463a22400625e09d522edf16fc37f4534faea6a34dbeb4592794343d8f3f8f09de55e46191c7dd

Score
10/10
404keyloggercollectionkeyloggerstealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    isabellsepindler3@gmail.com
  • Password:
    kakokako12345

Signatures

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

    stealerkeylogger404keylogger
  • 404 Keylogger Main Executable 4 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f03ff2d346e59f0e9d9e51569b08fba6c610e7c82fd92719866124bd512054f.exe
    "C:\Users\Admin\AppData\Local\Temp\6f03ff2d346e59f0e9d9e51569b08fba6c610e7c82fd92719866124bd512054f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1252-54-0x0000000075B71000-0x0000000075B73000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1252-64-0x0000000000120000-0x0000000000139000-memory.dmp
    Filesize

    100KB

    Download
  • memory/1612-55-0x0000000000080000-0x000000000009E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1612-57-0x0000000000080000-0x000000000009E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1612-62-0x0000000000099D7E-mapping.dmp
    Download
  • memory/1612-63-0x0000000000080000-0x000000000009E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1612-65-0x0000000000080000-0x000000000009E000-memory.dmp
    Filesize

    120KB

    Download