Analysis
- max time kernel
100s - max time network
109s - platform
windows7_x64 - resource
win7 - submitted
15/07/2020, 13:44
General
- Target RFQ.exe
- Size 1.5MB
- Sample200715-57f5h5ld6e
- SHA256 127d38ba33a67b3fa64e954d209cd9276b5d548462cd47cc3abafa8192073bab
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/15/2020 1:45:47 PM MassLogger Started: 7/15/2020 1:45:44 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RFQ.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.ru
-
Port
587
-
Username
-
Password
@jaffinmarknma@344
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eHCGjWXlgRYmBE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33CC.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1792-4-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-6-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-7-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-8-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-9-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-10-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-11-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-12-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-13-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-14-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-15-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-16-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-17-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-18-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-19-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-20-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-21-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-22-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-23-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-24-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-25-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-26-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-27-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-28-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-29-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-30-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-31-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-32-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-33-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-34-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-35-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-36-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-37-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-38-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-39-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-40-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-41-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-42-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-43-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-44-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-45-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-46-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-47-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-48-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-49-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-50-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-51-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-52-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-53-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-54-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-55-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-56-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-57-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-58-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-59-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-60-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-61-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-62-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-63-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-64-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-65-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-66-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-67-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-68-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-69-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-70-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-71-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-72-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-73-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-74-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-75-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-76-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-77-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-78-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-79-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-80-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-81-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-82-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-83-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-84-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-85-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-86-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-87-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-88-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-89-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-90-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-91-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-92-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-93-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-94-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-95-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-96-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-97-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-98-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-99-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-100-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-101-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-102-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-103-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-104-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-105-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-106-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-107-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-108-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-109-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-110-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-111-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-112-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-113-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-114-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-115-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-116-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-117-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-118-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-119-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-120-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-121-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-122-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-123-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-124-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-125-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-126-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-127-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-128-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-129-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-130-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-131-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-132-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-133-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-134-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-135-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-136-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-137-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-138-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-139-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-140-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-141-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-142-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-143-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-144-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-145-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-146-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-147-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-148-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-149-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-150-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-151-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-152-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-153-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-154-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-155-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-156-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-157-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-158-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-159-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-160-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-161-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-162-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-163-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-164-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-165-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-166-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-167-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-168-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-169-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-170-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-171-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-172-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-173-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-174-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-175-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-176-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-177-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-178-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-179-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-180-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-181-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-182-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-183-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-184-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-185-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-186-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-187-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-188-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-189-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-190-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-191-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-192-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-193-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-194-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-195-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-196-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-197-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-198-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-199-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-200-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-201-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-202-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-203-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-204-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-205-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-206-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-207-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-208-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-209-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-210-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-211-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-212-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-213-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-214-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-215-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-216-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-217-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-218-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-219-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-220-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-221-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-222-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-223-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-224-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-225-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-226-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-227-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-228-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-229-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-230-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-231-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-232-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-233-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-234-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-235-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-236-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-237-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-238-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-239-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-240-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-241-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-242-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-243-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-244-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-245-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-246-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-247-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-248-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-249-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-250-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-251-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-252-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-253-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-254-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-255-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-256-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-257-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-258-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-259-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-260-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-261-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-262-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-263-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-264-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1792-265-0x0000000000400000-0x00000000004B2000-memory.dmp