litehttp | 6688a94f9872a333a01e925207a7a356dfb8e7083926cd5218a572ec67c2d458

General

Target

S7fiTRL.exe
Size

56KB
MD5

c8723bca6d83cbad8cbc75ae323d749d
SHA1

e40e8e84186286495aaff872e74afd6bd9c0aafd
SHA256

6688a94f9872a333a01e925207a7a356dfb8e7083926cd5218a572ec67c2d458
SHA512

28e902f13fbd8cca7cab58df38306d85e62c98eced62e96bffce205a3bdf1f0f411830ed77373905ba6ae040536dc6da188fbdaec1db6f63e97e50e50c5a9700
SSDEEP

1536:DMOiQ4BKCxOhU8WdJmQ/KawN9Qe6cr9bAJZXjof4vLa0:DxizBKCyU8WdJmQ/KawN9/r9bAJZXjiY

Score

10^/10

litehttp bot defense_evasion execution persistence privilege_escalation stealer

Malware Config

Extracted

Family

litehttp

Version

v1.0.10

C2

http://185.208.156.162/page.php

Attributes

key
v1d6kd29g85cm8jp4pv8tvflvg303gbl

Signatures

LiteHTTP
LiteHTTP is an open-source bot written in C#.
stealer bot litehttp
Litehttp family
litehttp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2904	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anubis.exe	S7fiTRL.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anubis.lnk	S7fiTRL.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\Anubis = "\"C:\\Users\\Admin\\AppData\\Roaming\\Local\\Caches\\hi5slJzV\\Anubis.exe\""	S7fiTRL.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
2732	verclsid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\CLSID\{4A5481A5-BDBE-42AF-A535-1BC65F5DBD34}\InProcServer32	S7fiTRL.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\CLSID	S7fiTRL.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\CLSID\{4A5481A5-BDBE-42AF-A535-1BC65F5DBD34}	S7fiTRL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\CLSID\{4A5481A5-BDBE-42AF-A535-1BC65F5DBD34}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Local\\Caches\\hi5slJzV\\Anubis.exe"	S7fiTRL.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
272	S7fiTRL.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
272	S7fiTRL.exe
272	S7fiTRL.exe
272	S7fiTRL.exe
272	S7fiTRL.exe
2904	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	272	S7fiTRL.exe
Token: SeDebugPrivilege	2904	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 2904	272	S7fiTRL.exe	31
PID 272 wrote to memory of 2904	272	S7fiTRL.exe	31
PID 272 wrote to memory of 2904	272	S7fiTRL.exe	31

C:\Users\Admin\AppData\Local\Temp\S7fiTRL.exe
"C:\Users\Admin\AppData\Local\Temp\S7fiTRL.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\hi5slJzV\Anubis.exe""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {4A5481A5-BDBE-42AF-A535-1BC65F5DBD34} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Modify Registry

1

T1112

System Binary Proxy Execution

1

T1218

Verclsid

1

T1218.012

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Local\Caches\hi5slJzV\Anubis.exe

Filesize
56KB

MD5
c8723bca6d83cbad8cbc75ae323d749d

SHA1
e40e8e84186286495aaff872e74afd6bd9c0aafd

SHA256
6688a94f9872a333a01e925207a7a356dfb8e7083926cd5218a572ec67c2d458

SHA512
28e902f13fbd8cca7cab58df38306d85e62c98eced62e96bffce205a3bdf1f0f411830ed77373905ba6ae040536dc6da188fbdaec1db6f63e97e50e50c5a9700

Download Submit
memory/272-0-0x000007FEF5073000-0x000007FEF5074000-memory.dmp

Filesize
4KB

Download
memory/272-1-0x00000000000E0000-0x00000000000F4000-memory.dmp

Filesize
80KB

Download
memory/272-2-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download
memory/272-3-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

Filesize
9.9MB

Download
memory/272-4-0x000007FEF5073000-0x000007FEF5074000-memory.dmp

Filesize
4KB

Download
memory/272-5-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

Filesize
9.9MB

Download
memory/2904-19-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2904-20-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2904-21-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads