Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 06:51
Static task
static1
Behavioral task
behavioral1
Sample
e8680b7a890458b72e5118b62a6ab97c.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
e8680b7a890458b72e5118b62a6ab97c.exe
Resource
win10
General
-
Target
e8680b7a890458b72e5118b62a6ab97c.exe
-
Size
1.1MB
-
MD5
e8680b7a890458b72e5118b62a6ab97c
-
SHA1
6e0ea318e9c238782466f47b7b3f0ed142a4b26d
-
SHA256
4eba9f4975de4fad373ec97aace6605f55249174c4dfc78c87f5567c98557210
-
SHA512
0273c0e921580832362bac6668c8336fc95aa177f0987bfd62399c619c6c6d1b51122688293726e4bffedbffb97f4f6c45716d142875e0f30ea7f2063a1f53d1
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/3852-4-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3852-8-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3852-10-0x0000000000400000-0x0000000000541000-memory.dmp upx -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\app\hjiwws.exe:ZoneIdentifier notepad.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs notepad.exe -
Suspicious behavior: EnumeratesProcesses 2650 IoCs
Processes:
e8680b7a890458b72e5118b62a6ab97c.exehjiwws.exehjiwws.exepid process 4092 e8680b7a890458b72e5118b62a6ab97c.exe 4092 e8680b7a890458b72e5118b62a6ab97c.exe 3368 hjiwws.exe 3368 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe 3912 hjiwws.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
hjiwws.exepid process 3368 hjiwws.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hjiwws.exedescription pid process target process PID 3368 set thread context of 3852 3368 hjiwws.exe hjiwws.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hjiwws.exedescription pid process Token: SeDebugPrivilege 3852 hjiwws.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
e8680b7a890458b72e5118b62a6ab97c.exenotepad.exehjiwws.exedescription pid process target process PID 4092 wrote to memory of 3172 4092 e8680b7a890458b72e5118b62a6ab97c.exe notepad.exe PID 4092 wrote to memory of 3172 4092 e8680b7a890458b72e5118b62a6ab97c.exe notepad.exe PID 4092 wrote to memory of 3172 4092 e8680b7a890458b72e5118b62a6ab97c.exe notepad.exe PID 4092 wrote to memory of 3172 4092 e8680b7a890458b72e5118b62a6ab97c.exe notepad.exe PID 4092 wrote to memory of 3172 4092 e8680b7a890458b72e5118b62a6ab97c.exe notepad.exe PID 3172 wrote to memory of 3368 3172 notepad.exe hjiwws.exe PID 3172 wrote to memory of 3368 3172 notepad.exe hjiwws.exe PID 3172 wrote to memory of 3368 3172 notepad.exe hjiwws.exe PID 3368 wrote to memory of 3852 3368 hjiwws.exe hjiwws.exe PID 3368 wrote to memory of 3852 3368 hjiwws.exe hjiwws.exe PID 3368 wrote to memory of 3852 3368 hjiwws.exe hjiwws.exe PID 3368 wrote to memory of 3912 3368 hjiwws.exe hjiwws.exe PID 3368 wrote to memory of 3912 3368 hjiwws.exe hjiwws.exe PID 3368 wrote to memory of 3912 3368 hjiwws.exe hjiwws.exe -
Executes dropped EXE 3 IoCs
Processes:
hjiwws.exehjiwws.exehjiwws.exepid process 3368 hjiwws.exe 3852 hjiwws.exe 3912 hjiwws.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
hjiwws.exepid process 3852 hjiwws.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
hjiwws.exepid process 3852 hjiwws.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8680b7a890458b72e5118b62a6ab97c.exe"C:\Users\Admin\AppData\Local\Temp\e8680b7a890458b72e5118b62a6ab97c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- NTFS ADS
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"C:\Users\Admin\AppData\Roaming\app\hjiwws.exe" 2 3852 696404⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe
-
memory/3172-0-0x0000000000000000-mapping.dmp
-
memory/3368-1-0x0000000000000000-mapping.dmp
-
memory/3852-5-0x000000000053F7F0-mapping.dmp
-
memory/3852-4-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3852-8-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3852-10-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3852-11-0x00000000022F0000-0x000000000238A000-memory.dmpFilesize
616KB
-
memory/3852-12-0x0000000000A72000-0x0000000000A73000-memory.dmpFilesize
4KB
-
memory/3912-7-0x0000000000000000-mapping.dmp