Analysis
-
max time kernel
135s -
max time network
137s -
platform
windows10_x64 -
resource
win10 -
submitted
09-07-2020 06:29
Static task
static1
Behavioral task
behavioral1
Sample
Bank Statement_pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
Bank Statement_pdf.exe
Resource
win10
General
-
Target
Bank Statement_pdf.exe
-
Size
899KB
-
MD5
1c3985f5c3ad3e9a5394d093237ecd72
-
SHA1
9d3c319ac9c93ed1227c7808f8a8a16b935a6fcf
-
SHA256
e91593299dba4d7f9362c8d64e701413af0384f0f7ecca356ab138497f3a8e4d
-
SHA512
3f3ce2ddac434d8bc8cb8f5c376b31e63d54ccfb809907542bb5b0f6094a01049ba6e15e20e5c6b3af815248e3ec6ea1993194b68eeb78743fd88c7ec5037511
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Bank Statement_pdf.exepid process 3876 Bank Statement_pdf.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Bank Statement_pdf.exeBank Statement_pdf.exepid process 3820 Bank Statement_pdf.exe 3820 Bank Statement_pdf.exe 3876 Bank Statement_pdf.exe 3876 Bank Statement_pdf.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Bank Statement_pdf.exepid process 3820 Bank Statement_pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bank Statement_pdf.exedescription pid process target process PID 3820 set thread context of 3876 3820 Bank Statement_pdf.exe Bank Statement_pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Bank Statement_pdf.exedescription pid process Token: SeDebugPrivilege 3876 Bank Statement_pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Bank Statement_pdf.exedescription pid process target process PID 3820 wrote to memory of 3876 3820 Bank Statement_pdf.exe Bank Statement_pdf.exe PID 3820 wrote to memory of 3876 3820 Bank Statement_pdf.exe Bank Statement_pdf.exe PID 3820 wrote to memory of 3876 3820 Bank Statement_pdf.exe Bank Statement_pdf.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Bank Statement_pdf.exepid process 3876 Bank Statement_pdf.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/3876-0-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3876-2-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3876-3-0x0000000000400000-0x0000000000541000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Statement_pdf.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3876-0-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3876-1-0x000000000053FAE0-mapping.dmp
-
memory/3876-2-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3876-3-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3876-4-0x0000000002420000-0x00000000024BA000-memory.dmpFilesize
616KB
-
memory/3876-5-0x00000000022D2000-0x00000000022D3000-memory.dmpFilesize
4KB