Analysis
-
max time kernel
129s -
max time network
136s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
10-07-2020 05:31
Static task
static1
Behavioral task
behavioral1
Sample
SWIT BAN.EXE
Resource
win7v200430
Behavioral task
behavioral2
Sample
SWIT BAN.EXE
Resource
win10
General
-
Target
SWIT BAN.EXE
-
Size
1.3MB
-
MD5
1aa318b5c4ad4d54c98e55d54cda70b0
-
SHA1
b5bc6828d418389f09c6a0543545075f2cd1b0ae
-
SHA256
f316c85b920176e192357ff4b735f6d1b99fd7af2f23e24b80e3aef4fd2522ba
-
SHA512
60c2523f341df94bd4be1a38c6d0c3c49d59f3730da7ba3d0d7c1cdb02944f460e24176d06f894b232cace9e61b0a879d8a9fa9f0d237e3ea6475f71c4ed1fd0
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\C8A579F880\Log.txt
masslogger
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 272 set thread context of 736 272 SWIT BAN.EXE 24 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 736 SWIT BAN.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 736 SWIT BAN.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 272 wrote to memory of 736 272 SWIT BAN.EXE 24 PID 272 wrote to memory of 736 272 SWIT BAN.EXE 24 PID 272 wrote to memory of 736 272 SWIT BAN.EXE 24 PID 272 wrote to memory of 736 272 SWIT BAN.EXE 24 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 272 SWIT BAN.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 736 SWIT BAN.EXE -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
resource yara_rule behavioral1/memory/736-0-0x0000000000400000-0x0000000000567000-memory.dmp upx behavioral1/memory/736-2-0x0000000000400000-0x0000000000567000-memory.dmp upx behavioral1/memory/736-3-0x0000000000400000-0x0000000000567000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 272 SWIT BAN.EXE 736 SWIT BAN.EXE 736 SWIT BAN.EXE -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
yara_rule masslogger_log_file
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIT BAN.EXE"C:\Users\Admin\AppData\Local\Temp\SWIT BAN.EXE"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
PID:272 -
C:\Users\Admin\AppData\Local\Temp\SWIT BAN.EXE"C:\Users\Admin\AppData\Local\Temp\SWIT BAN.EXE"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:736
-