Analysis
-
max time kernel
98s -
max time network
151s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 07:38
Static task
static1
Behavioral task
behavioral1
Sample
m1pZYGiBFonndjG.exe
Resource
win7
Behavioral task
behavioral2
Sample
m1pZYGiBFonndjG.exe
Resource
win10
General
-
Target
m1pZYGiBFonndjG.exe
-
Size
1.0MB
-
MD5
5da5e488f088c67f1bc677baab5b75b8
-
SHA1
169b9253cfd6bfbf8a67e3e784b94e46dca4e58f
-
SHA256
e06e5ba87ec0ed09101fcd62c238777c90c6a59be6bba4ced6890250948e6a4b
-
SHA512
038e377d4651f539e81d7cf05d68612b8c82661926695441cb3987eb4a8f8e812ef428d9a89fdd8928682a2369bd0b273286a29ed8f1ffa3b8890dcd848d51a6
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
m1pZYGiBFonndjG.exedescription pid process target process PID 1464 wrote to memory of 1344 1464 m1pZYGiBFonndjG.exe schtasks.exe PID 1464 wrote to memory of 1344 1464 m1pZYGiBFonndjG.exe schtasks.exe PID 1464 wrote to memory of 1344 1464 m1pZYGiBFonndjG.exe schtasks.exe PID 1464 wrote to memory of 1344 1464 m1pZYGiBFonndjG.exe schtasks.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe PID 1464 wrote to memory of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
m1pZYGiBFonndjG.exedescription pid process target process PID 1464 set thread context of 1828 1464 m1pZYGiBFonndjG.exe m1pZYGiBFonndjG.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
m1pZYGiBFonndjG.exedescription pid process Token: SeDebugPrivilege 1828 m1pZYGiBFonndjG.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
m1pZYGiBFonndjG.exepid process 1828 m1pZYGiBFonndjG.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
m1pZYGiBFonndjG.exepid process 1828 m1pZYGiBFonndjG.exe 1828 m1pZYGiBFonndjG.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
m1pZYGiBFonndjG.exepid process 1828 m1pZYGiBFonndjG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\m1pZYGiBFonndjG.exe"C:\Users\Admin\AppData\Local\Temp\m1pZYGiBFonndjG.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1464 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OBySigjDNKEBB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp319A.tmp"2⤵
- Creates scheduled task(s)
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\m1pZYGiBFonndjG.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: AddClipboardFormatListener
PID:1828