Analysis
-
max time kernel
119s -
max time network
106s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 07:00
Static task
static1
Behavioral task
behavioral1
Sample
952110_2020713.exe
Resource
win7
Behavioral task
behavioral2
Sample
952110_2020713.exe
Resource
win10v200430
General
-
Target
952110_2020713.exe
-
Size
1.3MB
-
MD5
52e2dd01e70bce5aac4f44e19c2876e1
-
SHA1
bf7326838f7b86565769f1c122bdebbbf5b6a097
-
SHA256
f486c5d5fe3c9341cd331a8e6a68102a9bd7a9e7864c5179948c585806828006
-
SHA512
1ab82d5d08de1f877ec4c45d75597f4d584460bf37c6e8e271f6ebc74a452f14b39c84cc22b2bf8a3fadeaa53f87881dcacafeeedfcaf500d34e09a8f659ddbd
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
.exeRegAsm.exepid process 1832 .exe 1984 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
.exedescription pid process target process PID 1832 set thread context of 1984 1832 .exe RegAsm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\admin = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Desktop\\.exe" reg.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
952110_2020713.exe.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 616 952110_2020713.exe Token: SeDebugPrivilege 1832 .exe Token: SeDebugPrivilege 1984 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
952110_2020713.exe.exeRegAsm.exepid process 616 952110_2020713.exe 616 952110_2020713.exe 616 952110_2020713.exe 1832 .exe 1832 .exe 1832 .exe 1984 RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
952110_2020713.execmd.exe.exedescription pid process target process PID 616 wrote to memory of 240 616 952110_2020713.exe cmd.exe PID 616 wrote to memory of 240 616 952110_2020713.exe cmd.exe PID 616 wrote to memory of 240 616 952110_2020713.exe cmd.exe PID 616 wrote to memory of 240 616 952110_2020713.exe cmd.exe PID 240 wrote to memory of 1072 240 cmd.exe reg.exe PID 240 wrote to memory of 1072 240 cmd.exe reg.exe PID 240 wrote to memory of 1072 240 cmd.exe reg.exe PID 240 wrote to memory of 1072 240 cmd.exe reg.exe PID 616 wrote to memory of 1832 616 952110_2020713.exe .exe PID 616 wrote to memory of 1832 616 952110_2020713.exe .exe PID 616 wrote to memory of 1832 616 952110_2020713.exe .exe PID 616 wrote to memory of 1832 616 952110_2020713.exe .exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe PID 1832 wrote to memory of 1984 1832 .exe RegAsm.exe -
Loads dropped DLL 3 IoCs
Processes:
952110_2020713.exe.exeRegAsm.exepid process 616 952110_2020713.exe 1832 .exe 1984 RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\952110_2020713.exe"C:\Users\Admin\AppData\Local\Temp\952110_2020713.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v admin /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v admin /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\.exe"3⤵
- Adds Run entry to start application
-
C:\Users\Admin\Desktop\.exe"C:\Users\Admin\Desktop\.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
C:\Users\Admin\Desktop\.exe
-
C:\Users\Admin\Desktop\.exe
-
\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
\Users\Admin\AppData\Local\Temp\RegAsm.exe
-
\Users\Admin\Desktop\.exe
-
memory/240-3-0x0000000000000000-mapping.dmp
-
memory/616-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1072-4-0x0000000000000000-mapping.dmp
-
memory/1832-6-0x0000000000000000-mapping.dmp
-
memory/1984-18-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1984-19-0x000000000049415E-mapping.dmp
-
memory/1984-21-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1984-22-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB