Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 09:55
Static task
static1
Behavioral task
behavioral1
Sample
CAII000080521.exe
Resource
win7
Behavioral task
behavioral2
Sample
CAII000080521.exe
Resource
win10v200430
General
-
Target
CAII000080521.exe
-
Size
1.2MB
-
MD5
017ecc0d306245e81566079ecf525be6
-
SHA1
aa2f5b1650a9d26aca637a3d9b72e94e9acbd244
-
SHA256
f7d1402eb35c67bfb9f0cdf77c4050fc40c936fc0034d8b86bdbd20deed76db0
-
SHA512
0c12c196b414356fa04f1772b1562d7d3eaee5787b52fe2cf8697ffa4b317319db57dd1f13ce768cca9f6ef9bfb62c908d4fc7f448cfd8432f8d1c883a3ac7d2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
CAII000080521.execmd.exefirefoxx.exedescription pid process target process PID 1496 wrote to memory of 452 1496 CAII000080521.exe cmd.exe PID 1496 wrote to memory of 452 1496 CAII000080521.exe cmd.exe PID 1496 wrote to memory of 452 1496 CAII000080521.exe cmd.exe PID 1496 wrote to memory of 452 1496 CAII000080521.exe cmd.exe PID 452 wrote to memory of 1060 452 cmd.exe reg.exe PID 452 wrote to memory of 1060 452 cmd.exe reg.exe PID 452 wrote to memory of 1060 452 cmd.exe reg.exe PID 452 wrote to memory of 1060 452 cmd.exe reg.exe PID 1496 wrote to memory of 1692 1496 CAII000080521.exe firefoxx.exe PID 1496 wrote to memory of 1692 1496 CAII000080521.exe firefoxx.exe PID 1496 wrote to memory of 1692 1496 CAII000080521.exe firefoxx.exe PID 1496 wrote to memory of 1692 1496 CAII000080521.exe firefoxx.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe PID 1692 wrote to memory of 1868 1692 firefoxx.exe RegAsm.exe -
Loads dropped DLL 3 IoCs
Processes:
CAII000080521.exefirefoxx.exeRegAsm.exepid process 1496 CAII000080521.exe 1692 firefoxx.exe 1868 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
firefoxx.exedescription pid process target process PID 1692 set thread context of 1868 1692 firefoxx.exe RegAsm.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefoxx = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\firefoxx.exe" reg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
CAII000080521.exefirefoxx.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1496 CAII000080521.exe Token: SeDebugPrivilege 1692 firefoxx.exe Token: SeDebugPrivilege 1868 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
CAII000080521.exefirefoxx.exeRegAsm.exepid process 1496 CAII000080521.exe 1496 CAII000080521.exe 1496 CAII000080521.exe 1692 firefoxx.exe 1692 firefoxx.exe 1692 firefoxx.exe 1868 RegAsm.exe -
Executes dropped EXE 2 IoCs
Processes:
firefoxx.exeRegAsm.exepid process 1692 firefoxx.exe 1868 RegAsm.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CAII000080521.exe"C:\Users\Admin\AppData\Local\Temp\CAII000080521.exe"1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v firefoxx /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v firefoxx /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe"3⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe
-
\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe
-
memory/452-3-0x0000000000000000-mapping.dmp
-
memory/1060-4-0x0000000000000000-mapping.dmp
-
memory/1496-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1692-6-0x0000000000000000-mapping.dmp
-
memory/1868-14-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1868-15-0x000000000049451E-mapping.dmp
-
memory/1868-17-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1868-18-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB