Analysis
- max time kernel
140s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
07/03/2025, 08:00
General
- Target df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2.exe
- Size 48KB
- Sample250307-jv45tswxes
- SHA256 df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2
Malware Config
Extracted
-
litehttp
-
v1.0.9
-
http://185.208.156.162/page.php
-
key
v1d6kd29g85cm8jp4pv8tvflvg303gbl
Signatures
- LiteHTTP
LiteHTTP is an open-source bot written in C#.
- Litehttp family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2.exe"C:\Users\Admin\AppData\Local\Temp\df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\JjB4i4pd\Anubis.exe""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zcsrbztb.ppo.ps1
memory/428-3-0x00007FFB2FE30000-0x00007FFB308F1000-memory.dmp
memory/428-2-0x000001DF63C90000-0x000001DF63CA0000-memory.dmp
memory/428-0-0x00007FFB2FE33000-0x00007FFB2FE35000-memory.dmp
memory/428-6-0x000001DF7CAA0000-0x000001DF7CFC8000-memory.dmp
memory/428-7-0x00007FFB2FE30000-0x00007FFB308F1000-memory.dmp
memory/428-1-0x000001DF62020000-0x000001DF62032000-memory.dmp
memory/428-25-0x000001DF7C670000-0x000001DF7C772000-memory.dmp
memory/1468-9-0x00007FFB2FE30000-0x00007FFB308F1000-memory.dmp
memory/1468-10-0x00007FFB2FE30000-0x00007FFB308F1000-memory.dmp
memory/1468-18-0x0000023528870000-0x0000023528892000-memory.dmp
memory/1468-21-0x00007FFB2FE30000-0x00007FFB308F1000-memory.dmp
memory/1468-24-0x00007FFB2FE30000-0x00007FFB308F1000-memory.dmp