Analysis
-
max time kernel
130s -
max time network
146s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 14:18
Static task
static1
Behavioral task
behavioral1
Sample
CHQVYTExcSl0dUj.exe
Resource
win7
Behavioral task
behavioral2
Sample
CHQVYTExcSl0dUj.exe
Resource
win10
General
-
Target
CHQVYTExcSl0dUj.exe
-
Size
699KB
-
MD5
324f0d16fb470fca906fc47cf20f9407
-
SHA1
c105e1f0e721a50830f4adb0172bf46025c4e1f8
-
SHA256
521fdcdefe26b74dfe10386220135f67ca1270e945270287eb7b984b390536ee
-
SHA512
a21f1479443c71fdf9c92f365dca973d11e06ebc0be74e43e771716a7451a3b30d6090b36dc6cf31ff4aae6ad9791d9460ab0fc3d06b710cb17134801efec75b
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt
masslogger
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
CHQVYTExcSl0dUj.exeCHQVYTExcSl0dUj.exedescription pid process Token: SeDebugPrivilege 608 CHQVYTExcSl0dUj.exe Token: SeDebugPrivilege 1824 CHQVYTExcSl0dUj.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
CHQVYTExcSl0dUj.exeCHQVYTExcSl0dUj.exepid process 608 CHQVYTExcSl0dUj.exe 1824 CHQVYTExcSl0dUj.exe 1824 CHQVYTExcSl0dUj.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CHQVYTExcSl0dUj.exedescription pid process target process PID 608 set thread context of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
CHQVYTExcSl0dUj.exepid process 1824 CHQVYTExcSl0dUj.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
CHQVYTExcSl0dUj.exepid process 1824 CHQVYTExcSl0dUj.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
CHQVYTExcSl0dUj.exedescription pid process target process PID 608 wrote to memory of 1352 608 CHQVYTExcSl0dUj.exe schtasks.exe PID 608 wrote to memory of 1352 608 CHQVYTExcSl0dUj.exe schtasks.exe PID 608 wrote to memory of 1352 608 CHQVYTExcSl0dUj.exe schtasks.exe PID 608 wrote to memory of 1352 608 CHQVYTExcSl0dUj.exe schtasks.exe PID 608 wrote to memory of 1836 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1836 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1836 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1836 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe PID 608 wrote to memory of 1824 608 CHQVYTExcSl0dUj.exe CHQVYTExcSl0dUj.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org
Processes
-
C:\Users\Admin\AppData\Local\Temp\CHQVYTExcSl0dUj.exe"C:\Users\Admin\AppData\Local\Temp\CHQVYTExcSl0dUj.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oyCpWUGuRiwuHQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB46.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\CHQVYTExcSl0dUj.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\CHQVYTExcSl0dUj.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB46.tmp
-
memory/608-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1352-2-0x0000000000000000-mapping.dmp
-
memory/1824-4-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1824-5-0x00000000004893AE-mapping.dmp
-
memory/1824-6-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1824-7-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB