Analysis
-
max time kernel
139s -
max time network
121s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 06:27
Static task
static1
Behavioral task
behavioral1
Sample
purchase order.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
purchase order.exe
Resource
win10
General
-
Target
purchase order.exe
-
Size
790KB
-
MD5
3c55253fc699ca4f3aa7b5f39796e82c
-
SHA1
85be2e70b90bbefdb191cd5440c9519772755402
-
SHA256
420541ff7ab7f97d2110f9c2f2488087c0d2f9e577fa5e55c73eebf4f5416bbc
-
SHA512
bedb39cfab073dfce9e12488818d20381e48ec33cbfe30c53f5e1679b439b261c65cbf448f1a6d616c74f337f0dbcfd70194b141abc2399eed703210e0b1e297
Malware Config
Signatures
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
purchase order.exedescription pid process Token: SeDebugPrivilege 1856 purchase order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
purchase order.exedescription pid process target process PID 1312 set thread context of 1856 1312 purchase order.exe purchase order.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
purchase order.exepid process 1856 purchase order.exe -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
purchase order.exedescription pid process target process PID 1312 wrote to memory of 1820 1312 purchase order.exe schtasks.exe PID 1312 wrote to memory of 1820 1312 purchase order.exe schtasks.exe PID 1312 wrote to memory of 1820 1312 purchase order.exe schtasks.exe PID 1312 wrote to memory of 1820 1312 purchase order.exe schtasks.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe PID 1312 wrote to memory of 1856 1312 purchase order.exe purchase order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\purchase order.exe"C:\Users\Admin\AppData\Local\Temp\purchase order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iVrhdqTQlx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp729F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\purchase order.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp729F.tmp
-
memory/1312-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1820-2-0x0000000000000000-mapping.dmp
-
memory/1856-4-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1856-5-0x00000000004940BE-mapping.dmp
-
memory/1856-6-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1856-7-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB