Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 18:31
Static task
static1
Behavioral task
behavioral1
Sample
Sales note PO53.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Sales note PO53.exe
Resource
win10v200430
General
-
Target
Sales note PO53.exe
-
Size
861KB
-
MD5
3e414d89b9f98f4cc6c5988634791c0a
-
SHA1
fd7d1e1c6b49b97db475ccc56958bee3964ad766
-
SHA256
1c2f10aaf4e8b9a9e90316e8b470616bac893609cd85374cb11bb4a1a3971e5b
-
SHA512
a7781136e267d2549d9f248830951170f4b6eaabbaa212df3307362a895414ae85ece41c25d1256e09302d5b1c603ca45d1e1753dac85ed5493acb2b8cbe6508
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Sales note PO53.exedescription pid process target process PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe PID 676 wrote to memory of 1712 676 Sales note PO53.exe Sales note PO53.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Sales note PO53.exedescription pid process target process PID 676 set thread context of 1712 676 Sales note PO53.exe Sales note PO53.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Sales note PO53.exedescription pid process Token: SeDebugPrivilege 1712 Sales note PO53.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Sales note PO53.exepid process 1712 Sales note PO53.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sales note PO53.exe"C:\Users\Admin\AppData\Local\Temp\Sales note PO53.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Sales note PO53.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1712-2-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1712-3-0x0000000000494ADE-mapping.dmp
-
memory/1712-4-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1712-5-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB