Analysis
- max time kernel
148s - max time network
151s - platform
windows10_x64 - resource
win10 - submitted
07/07/2020, 08:25
General
- Target shipping documents.exe
- Size 1.3MB
- Sample200707-kclmeexd7x
- SHA256 6d430704bd3c6594f4732ec7e0f4bc0b899e93ac4d82d7f32da912dc6bdb9c35
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\480F96756F\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/7/2020 8:25:30 AM MassLogger Started: 7/7/2020 8:25:27 AM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\shipping documents.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Signatures
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3860-0-0x0000000000400000-0x0000000000577000-memory.dmp
memory/3860-2-0x0000000000400000-0x0000000000577000-memory.dmp
memory/3860-3-0x0000000000400000-0x0000000000577000-memory.dmp
memory/3860-4-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-5-0x0000000000602000-0x0000000000603000-memory.dmp
memory/3860-6-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-7-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-8-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-9-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-10-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-11-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-12-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-13-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-14-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-15-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-16-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-17-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-18-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-19-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-20-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-21-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-22-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-23-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-24-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-25-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-26-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-28-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-27-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-29-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-30-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-31-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-32-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-33-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-34-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-35-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-36-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-37-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-38-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-39-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-40-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-41-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-42-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-43-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-44-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-45-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-46-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-47-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-48-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-49-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-50-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-51-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-52-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-53-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-54-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-55-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-56-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-57-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-58-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-59-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-61-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-60-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-62-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-63-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-64-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-65-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-66-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-67-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-68-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-69-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-70-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-71-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-72-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-73-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-74-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-75-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-76-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-77-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-78-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-79-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-80-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-81-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-82-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-83-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-84-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-85-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-86-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-87-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-88-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-89-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-90-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-91-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-92-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-93-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-94-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-95-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-96-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-97-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-99-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-98-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-100-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-101-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-102-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-103-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-104-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-105-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-106-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-107-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-108-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-109-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-110-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-111-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-112-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-113-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-114-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-115-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-116-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-117-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-118-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-119-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-120-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-121-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-122-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-123-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-124-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-125-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-126-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-127-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-128-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-129-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-130-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-131-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-132-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-133-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-134-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-135-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-136-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-137-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-138-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-139-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-140-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-141-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-142-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-143-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-144-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-146-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-145-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-147-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-148-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-149-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-150-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-151-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-152-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-153-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-154-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-155-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-156-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-157-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-158-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-159-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-160-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-161-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-162-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-163-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-164-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-165-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-166-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-167-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-168-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-169-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-170-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-171-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-172-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-173-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-174-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-175-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-176-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-177-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-178-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-179-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-180-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-181-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-183-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-182-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-184-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-185-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-186-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-187-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-188-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-189-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-190-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-191-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-192-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-193-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-194-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-195-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-196-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-198-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-197-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-199-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-200-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-201-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-202-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-203-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-204-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-205-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-206-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-207-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-208-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-209-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-210-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-211-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-212-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-213-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-214-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-215-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-216-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-217-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-218-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-219-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-220-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-221-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-222-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-223-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-225-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-224-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-226-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-227-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-228-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-229-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-230-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-231-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-232-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-234-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-233-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-235-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-236-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-237-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-238-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-239-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-240-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-241-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-242-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-243-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-244-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-245-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-246-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-247-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-248-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-249-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-250-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-251-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-252-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-253-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-254-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-255-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-256-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-257-0x0000000002320000-0x00000000023D0000-memory.dmp
memory/3860-258-0x0000000002320000-0x00000000023D0000-memory.dmp