Analysis
- max time kernel
137s - max time network
125s - platform
windows7_x64 - resource
win7v200430 - submitted
02/07/2020, 07:51
General
- Target CATALOGUE RMK TRADING LTD_PDF.exe
- Size 815KB
- Sample200702-srtrbystt2
- SHA256 d087cb4fc608dfa1fa78c91ce168189bbc3e9c7bfbf7a7e60a050858be3770e0
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\C8A579F880\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 7 Professional 64bit CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/2/2020 9:52:40 AM MassLogger Started: 7/2/2020 9:52:32 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\CATALOGUE RMK TRADING LTD_PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.ru
-
Port
587
-
Username
-
Password
whayasaynewnew
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CATALOGUE RMK TRADING LTD_PDF.exe"C:\Users\Admin\AppData\Local\Temp\CATALOGUE RMK TRADING LTD_PDF.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CATALOGUE RMK TRADING LTD_PDF.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CATALOGUE RMK TRADING LTD_PDF.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1820-2-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-4-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-5-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-6-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-7-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-8-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-9-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-10-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-11-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-12-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-13-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-14-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-15-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-16-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-17-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-18-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-19-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-20-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-21-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-23-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-24-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-25-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-26-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-27-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-28-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-29-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-30-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-31-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-32-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-33-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-34-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-35-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-36-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-37-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-38-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-39-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-40-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-41-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-42-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-43-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-44-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-45-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-46-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-47-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-48-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-49-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-50-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-51-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-52-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-53-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-54-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-55-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-56-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-57-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-58-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-59-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-60-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-61-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-62-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-63-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-64-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-65-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-66-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-67-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-68-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-69-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-70-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-71-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-72-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-73-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-74-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-75-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-76-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-77-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-78-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-79-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-80-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-81-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-82-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-83-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-85-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-84-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-86-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-87-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-88-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-89-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-90-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-91-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-92-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-93-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-94-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-95-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-96-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-97-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-98-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-99-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-100-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-101-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-102-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-103-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-104-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-105-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-106-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-107-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-108-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-109-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-110-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-111-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-112-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-113-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-114-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-115-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-116-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-117-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-119-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-118-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-120-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-121-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-122-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-123-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-124-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-125-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-126-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-127-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-128-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-129-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-130-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-131-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-132-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-133-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-134-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-135-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-136-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-137-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-138-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-139-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-140-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-141-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-142-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-143-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-144-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-145-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-146-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-147-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-148-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-149-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-150-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-151-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-152-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-153-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-154-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-155-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-156-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-157-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-158-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-159-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-160-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-161-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-162-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-163-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-164-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-165-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-166-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-167-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-168-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-169-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-170-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-171-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-172-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-173-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-174-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-175-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-176-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-177-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-178-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-179-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-180-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-181-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-182-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-183-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-184-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-185-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-186-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-187-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-188-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-189-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-190-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-191-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-192-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-193-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-194-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-195-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-196-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-197-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-198-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-199-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-200-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-201-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-202-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-203-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-204-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-205-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-206-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-207-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-208-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-209-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-210-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-211-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-212-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-213-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-214-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-215-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-216-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-217-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-218-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-219-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-220-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-221-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-222-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-223-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-224-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-225-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-226-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-227-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-228-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-229-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-230-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-231-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-232-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-233-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-234-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-235-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-236-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-237-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-238-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-239-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-240-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-241-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-242-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-243-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-244-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-245-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-246-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-247-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-248-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-249-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-250-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-251-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-252-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-253-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-254-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-255-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-256-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-257-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-258-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1820-259-0x0000000000400000-0x00000000004B0000-memory.dmp