Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 06:29
General
-
Target
Bank Statement_pdf.exe
-
Size
899KB
-
MD5
1c3985f5c3ad3e9a5394d093237ecd72
-
SHA1
9d3c319ac9c93ed1227c7808f8a8a16b935a6fcf
-
SHA256
e91593299dba4d7f9362c8d64e701413af0384f0f7ecca356ab138497f3a8e4d
-
SHA512
3f3ce2ddac434d8bc8cb8f5c376b31e63d54ccfb809907542bb5b0f6094a01049ba6e15e20e5c6b3af815248e3ec6ea1993194b68eeb78743fd88c7ec5037511
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 4 IoCs
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
616KB
-
Filesize
4KB
-
Filesize
592KB