Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows7_x64 -
resource
win7 -
submitted
11-07-2020 05:59
Static task
static1
Behavioral task
behavioral1
Sample
0176a34057e7db4cc4810bb8eedad9cd.exe
Resource
win7
Behavioral task
behavioral2
Sample
0176a34057e7db4cc4810bb8eedad9cd.exe
Resource
win10v200430
General
-
Target
0176a34057e7db4cc4810bb8eedad9cd.exe
-
Size
1012KB
-
MD5
0176a34057e7db4cc4810bb8eedad9cd
-
SHA1
5efad940258c83d5d31212f291ff784079cee405
-
SHA256
407768d45386b545b588ceb938324586954e446132ecef0273b8067cbf1ce4d9
-
SHA512
0a78d3156ca824926eff67bef86fa9a33f623f5515cc4737e8c4d840fdb27684430c9751f58dfef82d790665855ff42a29b58bafd85d338948a78868253b34e1
Malware Config
Signatures
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
jskkd.exepid process 484 jskkd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
jskkd.exepid process 752 jskkd.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
jskkd.exepid process 752 jskkd.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe:ZoneIdentifier notepad.exe -
Suspicious behavior: EnumeratesProcesses 1370 IoCs
Processes:
0176a34057e7db4cc4810bb8eedad9cd.exejskkd.exejskkd.exepid process 1544 0176a34057e7db4cc4810bb8eedad9cd.exe 484 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe 1624 jskkd.exe -
Loads dropped DLL 2 IoCs
Processes:
notepad.exepid process 744 notepad.exe 744 notepad.exe -
Executes dropped EXE 3 IoCs
Processes:
jskkd.exejskkd.exejskkd.exepid process 484 jskkd.exe 752 jskkd.exe 1624 jskkd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
jskkd.exedescription pid process Token: SeDebugPrivilege 752 jskkd.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral1/memory/752-12-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/752-7-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/752-13-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fhukw.vbs notepad.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
0176a34057e7db4cc4810bb8eedad9cd.exenotepad.exejskkd.exedescription pid process target process PID 1544 wrote to memory of 744 1544 0176a34057e7db4cc4810bb8eedad9cd.exe notepad.exe PID 1544 wrote to memory of 744 1544 0176a34057e7db4cc4810bb8eedad9cd.exe notepad.exe PID 1544 wrote to memory of 744 1544 0176a34057e7db4cc4810bb8eedad9cd.exe notepad.exe PID 1544 wrote to memory of 744 1544 0176a34057e7db4cc4810bb8eedad9cd.exe notepad.exe PID 1544 wrote to memory of 744 1544 0176a34057e7db4cc4810bb8eedad9cd.exe notepad.exe PID 1544 wrote to memory of 744 1544 0176a34057e7db4cc4810bb8eedad9cd.exe notepad.exe PID 744 wrote to memory of 484 744 notepad.exe jskkd.exe PID 744 wrote to memory of 484 744 notepad.exe jskkd.exe PID 744 wrote to memory of 484 744 notepad.exe jskkd.exe PID 744 wrote to memory of 484 744 notepad.exe jskkd.exe PID 484 wrote to memory of 752 484 jskkd.exe jskkd.exe PID 484 wrote to memory of 752 484 jskkd.exe jskkd.exe PID 484 wrote to memory of 752 484 jskkd.exe jskkd.exe PID 484 wrote to memory of 752 484 jskkd.exe jskkd.exe PID 484 wrote to memory of 1624 484 jskkd.exe jskkd.exe PID 484 wrote to memory of 1624 484 jskkd.exe jskkd.exe PID 484 wrote to memory of 1624 484 jskkd.exe jskkd.exe PID 484 wrote to memory of 1624 484 jskkd.exe jskkd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
jskkd.exedescription pid process target process PID 484 set thread context of 752 484 jskkd.exe jskkd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0176a34057e7db4cc4810bb8eedad9cd.exe"C:\Users\Admin\AppData\Local\Temp\0176a34057e7db4cc4810bb8eedad9cd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- NTFS ADS
- Loads dropped DLL
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe"C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe"C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe"4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe"C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe" 2 752 647244⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe
-
C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe
-
C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe
-
C:\Users\Admin\AppData\Roaming\appdata\jskkd.exe
-
\Users\Admin\AppData\Roaming\appdata\jskkd.exe
-
\Users\Admin\AppData\Roaming\appdata\jskkd.exe
-
memory/484-4-0x0000000000000000-mapping.dmp
-
memory/744-0-0x0000000000000000-mapping.dmp
-
memory/744-1-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/752-13-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/752-7-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/752-8-0x000000000053FBC0-mapping.dmp
-
memory/752-12-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/752-14-0x0000000000550000-0x00000000005EA000-memory.dmpFilesize
616KB
-
memory/752-15-0x0000000000232000-0x0000000000233000-memory.dmpFilesize
4KB
-
memory/752-16-0x0000000000240000-0x00000000002D4000-memory.dmpFilesize
592KB
-
memory/1624-10-0x0000000000000000-mapping.dmp