Analysis
- max time kernel
139s - max time network
144s - platform
windows7_x64 - resource
win7v200430 - submitted
16/07/2020, 07:18
General
- Target SKBMT+ Order No. SO-001172_PDF_ PDF.exe
- Size 1.4MB
- Sample200716-kbtjd7fsca
- SHA256 51feba16fe4544448af69bc8c311f138aeec6d3c92114aaa9d00c427bbe240d8
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\C8A579F880\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 7 Professional 64bit CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/16/2020 9:18:53 AM MassLogger Started: 7/16/2020 9:18:46 AM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\SKBMT+ Order No. SO-001172_PDF_ PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKBMT+ Order No. SO-001172_PDF_ PDF.exe"C:\Users\Admin\AppData\Local\Temp\SKBMT+ Order No. SO-001172_PDF_ PDF.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\SKBMT+ Order No. SO-001172_PDF_ PDF.exe"C:\Users\Admin\AppData\Local\Temp\SKBMT+ Order No. SO-001172_PDF_ PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1844-3-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-5-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-6-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-7-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-8-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-9-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-11-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-10-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-12-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-13-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-14-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-15-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-16-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-17-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-18-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-19-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-20-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-21-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-23-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-24-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-25-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-26-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-27-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-28-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-29-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-30-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-31-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-32-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-33-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-34-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-35-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-36-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-37-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-38-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-39-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-40-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-41-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-42-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-43-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-44-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-45-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-46-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-47-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-48-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-49-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-50-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-51-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-52-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-53-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-54-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-55-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-56-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-57-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-58-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-59-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-60-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-61-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-62-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-63-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-64-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-65-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-66-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-67-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-68-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-69-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-70-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-71-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-72-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-73-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-74-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-75-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-76-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-77-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-78-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-79-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-80-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-81-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-82-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-83-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-84-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-85-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-86-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-87-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-88-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-89-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-90-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-91-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-92-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-93-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-94-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-95-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-96-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-97-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-98-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-99-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-100-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-101-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-102-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-103-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-104-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-105-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-106-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-107-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-108-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-109-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-110-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-111-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-112-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-113-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-114-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-115-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-116-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-117-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-118-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-119-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-120-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-121-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-122-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-123-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-124-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-125-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-126-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-127-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-128-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-129-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-130-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-131-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-132-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-133-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-134-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-135-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-136-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-137-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-138-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-139-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-140-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-141-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-142-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-143-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-144-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-145-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-146-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-147-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-148-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-149-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-150-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-151-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-152-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-153-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-154-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-155-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-156-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-157-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-158-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-159-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-160-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-161-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-162-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-163-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-164-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-165-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-166-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-167-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-168-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-169-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-170-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-171-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-172-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-173-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-174-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-175-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-176-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-177-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-178-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-179-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-180-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-181-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-182-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-183-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-184-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-185-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-186-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-187-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-188-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-189-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-190-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-191-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-192-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-193-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-194-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-195-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-196-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-197-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-198-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-199-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-200-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-201-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-202-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-203-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-204-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-205-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-206-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-207-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-208-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-209-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-210-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-211-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-212-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-213-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-214-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-215-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-216-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-217-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-218-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-219-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-220-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-221-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-222-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-223-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-224-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-225-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-226-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-227-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-228-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-229-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-230-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-231-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-232-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-233-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-234-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-235-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-236-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-237-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-238-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-239-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-240-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-241-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-242-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-243-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-244-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-245-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-246-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-247-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-248-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-249-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-250-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-251-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-252-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-253-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-254-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-255-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-256-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-257-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-258-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-259-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1844-260-0x0000000000400000-0x00000000004B0000-memory.dmp