Analysis
- max time kernel
101s - max time network
94s - platform
windows7_x64 - resource
win7v200430 - submitted
02/07/2020, 07:21
General
- Target Swift reciept.exe
- Size 901KB
- Sample200702-h7erc2fsls
- SHA256 873d9e2252783bc8e2e14a30b8f85f3034a8fbf6ade7aaa24a8173fb85dd092c
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\C8A579F880\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 7 Professional 64bit CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/2/2020 9:22:22 AM MassLogger Started: 7/2/2020 9:22:15 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Swift reciept.exe As Administrator: True
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
Dmacdavid
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of WriteProcessMemory 9 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift reciept.exe"C:\Users\Admin\AppData\Local\Temp\Swift reciept.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Swift reciept.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1804-2-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-4-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-5-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-6-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-7-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-8-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-9-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-10-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-11-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-12-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-13-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-14-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-15-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-16-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-17-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-18-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-19-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-20-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-21-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-22-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-23-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-24-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-25-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-26-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-27-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-28-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-29-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-30-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-31-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-32-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-33-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-34-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-35-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-36-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-37-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-38-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-39-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-40-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-41-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-42-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-43-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-44-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-45-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-46-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-47-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-48-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-49-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-50-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-51-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-52-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-53-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-54-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-55-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-56-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-57-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-58-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-59-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-60-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-61-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-62-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-63-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-64-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-65-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-66-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-67-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-68-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-69-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-70-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-71-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-72-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-73-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-74-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-75-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-76-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-77-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-78-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-80-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-79-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-81-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-82-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-83-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-84-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-85-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-86-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-87-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-88-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-89-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-90-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-91-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-92-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-93-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-94-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-95-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-96-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-97-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-98-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-99-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-100-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-101-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-102-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-103-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-104-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-105-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-106-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-107-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-108-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-109-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-110-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-111-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-112-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-113-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-114-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-115-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-116-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-117-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-118-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-119-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-120-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-121-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-122-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-123-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-124-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-125-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-126-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-127-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-128-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-129-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-130-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-131-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-132-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-133-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-134-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-135-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-136-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-137-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-138-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-139-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-140-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-141-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-142-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-143-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-144-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-145-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-146-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-147-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-148-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-149-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-150-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-151-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-152-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-153-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-154-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-155-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-156-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-157-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-158-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-159-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-160-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-161-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-162-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-163-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-164-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-165-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-166-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-167-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-168-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-169-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-170-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-171-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-172-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-173-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-174-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-175-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-176-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-177-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-178-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-179-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-180-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-181-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-182-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-183-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-184-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-185-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-186-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-187-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-188-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-189-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-190-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-191-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-192-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-193-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-194-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-195-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-196-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-197-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-198-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-199-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-200-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-201-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-202-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-203-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-204-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-205-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-206-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-207-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-208-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-209-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-210-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-211-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-212-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-213-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-214-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-215-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-216-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-217-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-218-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-219-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-220-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-221-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-222-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-223-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-224-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-225-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-226-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-227-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-228-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-229-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-230-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-231-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-232-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-233-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-234-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-235-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-236-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-237-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-238-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-239-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-240-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-241-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-242-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-243-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-244-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-245-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-246-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-247-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-248-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-249-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-250-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-251-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-252-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-253-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-254-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-255-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-256-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1804-257-0x0000000000400000-0x00000000004A6000-memory.dmp