Analysis
-
max time kernel
134s -
max time network
113s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 07:38
Static task
static1
Behavioral task
behavioral1
Sample
DcBAMuENpLqiAz9.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
DcBAMuENpLqiAz9.exe
Resource
win10
General
-
Target
DcBAMuENpLqiAz9.exe
-
Size
1.1MB
-
MD5
194227e1b6f66533df5c3e6273eb5dc5
-
SHA1
b6761021e7c40d59c1df641618bba748fa674d36
-
SHA256
b633d14b6eb77ceeae4348f54df5f0dd430df22e5455862edd2d13bd2d53ef6b
-
SHA512
3258a441980935a29e19798a2a3e19a141d807255ecd2ad9993d555316a32c91171674bcba2156f229abdeec415dee57d3e6af31950d5433b341b3c21074621d
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
DcBAMuENpLqiAz9.exeDcBAMuENpLqiAz9.exepid process 1056 DcBAMuENpLqiAz9.exe 1796 DcBAMuENpLqiAz9.exe 1796 DcBAMuENpLqiAz9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DcBAMuENpLqiAz9.exedescription pid process target process PID 1056 set thread context of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
DcBAMuENpLqiAz9.exepid process 1796 DcBAMuENpLqiAz9.exe -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
DcBAMuENpLqiAz9.exedescription pid process target process PID 1056 wrote to memory of 1800 1056 DcBAMuENpLqiAz9.exe schtasks.exe PID 1056 wrote to memory of 1800 1056 DcBAMuENpLqiAz9.exe schtasks.exe PID 1056 wrote to memory of 1800 1056 DcBAMuENpLqiAz9.exe schtasks.exe PID 1056 wrote to memory of 1800 1056 DcBAMuENpLqiAz9.exe schtasks.exe PID 1056 wrote to memory of 1764 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1764 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1764 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1764 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe PID 1056 wrote to memory of 1796 1056 DcBAMuENpLqiAz9.exe DcBAMuENpLqiAz9.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DcBAMuENpLqiAz9.exeDcBAMuENpLqiAz9.exedescription pid process Token: SeDebugPrivilege 1056 DcBAMuENpLqiAz9.exe Token: SeDebugPrivilege 1796 DcBAMuENpLqiAz9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
DcBAMuENpLqiAz9.exepid process 1796 DcBAMuENpLqiAz9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DcBAMuENpLqiAz9.exe"C:\Users\Admin\AppData\Local\Temp\DcBAMuENpLqiAz9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1056 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CTpVsVF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB65.tmp"2⤵
- Creates scheduled task(s)
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\DcBAMuENpLqiAz9.exe"{path}"2⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\DcBAMuENpLqiAz9.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1796