Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
13-07-2020 06:49
Static task
static1
Behavioral task
behavioral1
Sample
c45cefc699ab04e4709c9cd3e8a49bb3.exe
Resource
win7
Behavioral task
behavioral2
Sample
c45cefc699ab04e4709c9cd3e8a49bb3.exe
Resource
win10v200430
General
-
Target
c45cefc699ab04e4709c9cd3e8a49bb3.exe
-
Size
1.1MB
-
MD5
c45cefc699ab04e4709c9cd3e8a49bb3
-
SHA1
e4e34cdb66b393283bfd0441ac3d3fea3c492f89
-
SHA256
f5f9d13ad521590ab458db196ce2e06d2d832cd179f445a75a86bf2fedbfcf40
-
SHA512
1d015cd4fe98e700ec0b24cc4f5885ccb5f47ba544b8a508340accdf32ea62740b3a1f72346fe5e395c5a939d312e7cb7203f354e98f28cad698e8c84dff00d1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
c45cefc699ab04e4709c9cd3e8a49bb3.exenotepad.exehjiwws.exedescription pid process target process PID 1492 wrote to memory of 1664 1492 c45cefc699ab04e4709c9cd3e8a49bb3.exe notepad.exe PID 1492 wrote to memory of 1664 1492 c45cefc699ab04e4709c9cd3e8a49bb3.exe notepad.exe PID 1492 wrote to memory of 1664 1492 c45cefc699ab04e4709c9cd3e8a49bb3.exe notepad.exe PID 1492 wrote to memory of 1664 1492 c45cefc699ab04e4709c9cd3e8a49bb3.exe notepad.exe PID 1492 wrote to memory of 1664 1492 c45cefc699ab04e4709c9cd3e8a49bb3.exe notepad.exe PID 1664 wrote to memory of 1792 1664 notepad.exe hjiwws.exe PID 1664 wrote to memory of 1792 1664 notepad.exe hjiwws.exe PID 1664 wrote to memory of 1792 1664 notepad.exe hjiwws.exe PID 1792 wrote to memory of 2028 1792 hjiwws.exe hjiwws.exe PID 1792 wrote to memory of 2028 1792 hjiwws.exe hjiwws.exe PID 1792 wrote to memory of 2028 1792 hjiwws.exe hjiwws.exe PID 1792 wrote to memory of 2120 1792 hjiwws.exe hjiwws.exe PID 1792 wrote to memory of 2120 1792 hjiwws.exe hjiwws.exe PID 1792 wrote to memory of 2120 1792 hjiwws.exe hjiwws.exe -
Executes dropped EXE 3 IoCs
Processes:
hjiwws.exehjiwws.exehjiwws.exepid process 1792 hjiwws.exe 2028 hjiwws.exe 2120 hjiwws.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
hjiwws.exepid process 2028 hjiwws.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hjiwws.exedescription pid process target process PID 1792 set thread context of 2028 1792 hjiwws.exe hjiwws.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
hjiwws.exepid process 2028 hjiwws.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious behavior: EnumeratesProcesses 2678 IoCs
Processes:
c45cefc699ab04e4709c9cd3e8a49bb3.exehjiwws.exehjiwws.exepid process 1492 c45cefc699ab04e4709c9cd3e8a49bb3.exe 1492 c45cefc699ab04e4709c9cd3e8a49bb3.exe 1792 hjiwws.exe 1792 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe 2120 hjiwws.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/2028-4-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2028-8-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2028-10-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs notepad.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
hjiwws.exepid process 1792 hjiwws.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hjiwws.exedescription pid process Token: SeDebugPrivilege 2028 hjiwws.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\app\hjiwws.exe:ZoneIdentifier notepad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c45cefc699ab04e4709c9cd3e8a49bb3.exe"C:\Users\Admin\AppData\Local\Temp\c45cefc699ab04e4709c9cd3e8a49bb3.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious use of WriteProcessMemory
- Drops startup file
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe"C:\Users\Admin\AppData\Roaming\app\hjiwws.exe" 2 2028 1264214⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe
-
C:\Users\Admin\AppData\Roaming\app\hjiwws.exe
-
memory/1664-0-0x0000000000000000-mapping.dmp
-
memory/1792-1-0x0000000000000000-mapping.dmp
-
memory/2028-4-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2028-5-0x000000000053F760-mapping.dmp
-
memory/2028-8-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2028-10-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2028-11-0x00000000022E0000-0x000000000237A000-memory.dmpFilesize
616KB
-
memory/2028-12-0x00000000023D2000-0x00000000023D3000-memory.dmpFilesize
4KB
-
memory/2120-6-0x0000000000000000-mapping.dmp