litehttp | df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2

Analysis

max time kernel
117s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d39df45e0030e02f7e5035386244a523.exe
Size

48KB
MD5

d39df45e0030e02f7e5035386244a523
SHA1

9ae72545a0b6004cdab34f56031dc1c8aa146cc9
SHA256

df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2
SHA512

69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64
SSDEEP

768:RRMOTuQwOYZiyYcpbEzlwF2g9ap4nLBFvpzbHyV6N55IHFKSu87W78aETvqtnqUg:7MOiQwOYZEcKzlwb9u4nLbvpzLy0N55q

Score

10^/10

litehttp bot execution persistence stealer

Malware Config

Extracted

Family

litehttp

Version

v1.0.9

http://185.208.156.162/page.php

Attributes

key
v1d6kd29g85cm8jp4pv8tvflvg303gbl

Signatures

LiteHTTP
LiteHTTP is an open-source bot written in C#.
stealer bot litehttp
Litehttp family
litehttp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Anubis = "\"C:\\Users\\Admin\\AppData\\Roaming\\Local\\Caches\\wPg7ls1x\\Anubis.exe\""	d39df45e0030e02f7e5035386244a523.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1796	d39df45e0030e02f7e5035386244a523.exe
1796	d39df45e0030e02f7e5035386244a523.exe
1796	d39df45e0030e02f7e5035386244a523.exe
1796	d39df45e0030e02f7e5035386244a523.exe
2864	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	d39df45e0030e02f7e5035386244a523.exe
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2864	1796	d39df45e0030e02f7e5035386244a523.exe	31
PID 1796 wrote to memory of 2864	1796	d39df45e0030e02f7e5035386244a523.exe	31
PID 1796 wrote to memory of 2864	1796	d39df45e0030e02f7e5035386244a523.exe	31

C:\Users\Admin\AppData\Local\Temp\d39df45e0030e02f7e5035386244a523.exe
"C:\Users\Admin\AppData\Local\Temp\d39df45e0030e02f7e5035386244a523.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\wPg7ls1x\Anubis.exe""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/1796-1-0x0000000001170000-0x0000000001182000-memory.dmp

Filesize
72KB

Download
memory/1796-2-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/1796-3-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/1796-4-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/1796-5-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/2864-13-0x000007FEEEC1E000-0x000007FEEEC1F000-memory.dmp

Filesize
4KB

Download
memory/2864-14-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2864-16-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2864-17-0x000007FEEE960000-0x000007FEEF2FD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-15-0x000007FEEE960000-0x000007FEEF2FD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-18-0x000007FEEE960000-0x000007FEEF2FD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-19-0x000007FEEE960000-0x000007FEEF2FD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-20-0x000007FEEE960000-0x000007FEEF2FD000-memory.dmp

Filesize
9.6MB

Download
memory/2864-21-0x000007FEEE960000-0x000007FEEF2FD000-memory.dmp

Filesize
9.6MB

Download