Analysis
-
max time kernel
155s -
max time network
103s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
31-07-2020 12:01
Static task
static1
Behavioral task
behavioral1
Sample
2885d39472461249eea2d56856ea913a.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
2885d39472461249eea2d56856ea913a.exe
Resource
win10v200722
General
-
Target
2885d39472461249eea2d56856ea913a.exe
-
Size
928KB
-
MD5
2885d39472461249eea2d56856ea913a
-
SHA1
be776462df8db7324fd77a134935e6ed17ba6d0a
-
SHA256
311380e373e370131734bd5c65fe3b8a8b2862fc7049692e92ac12703487edc7
-
SHA512
2e85f2bfab8a6aab56ec4fd490b09f139d749536020681807c1bc5b0bc0425a5415678182cbf9834f5f67e0fedf21e18259ecf5b2c40f88f271fce93550d7a49
Malware Config
Extracted
C:\Users\Admin\AppData\Local\42EF15E83D\Log.txt
masslogger
Signatures
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
2885d39472461249eea2d56856ea913a.exenotepad.exeghjkzxijdk.exedescription pid process target process PID 844 wrote to memory of 284 844 2885d39472461249eea2d56856ea913a.exe notepad.exe PID 844 wrote to memory of 284 844 2885d39472461249eea2d56856ea913a.exe notepad.exe PID 844 wrote to memory of 284 844 2885d39472461249eea2d56856ea913a.exe notepad.exe PID 844 wrote to memory of 284 844 2885d39472461249eea2d56856ea913a.exe notepad.exe PID 844 wrote to memory of 284 844 2885d39472461249eea2d56856ea913a.exe notepad.exe PID 844 wrote to memory of 284 844 2885d39472461249eea2d56856ea913a.exe notepad.exe PID 284 wrote to memory of 1012 284 notepad.exe ghjkzxijdk.exe PID 284 wrote to memory of 1012 284 notepad.exe ghjkzxijdk.exe PID 284 wrote to memory of 1012 284 notepad.exe ghjkzxijdk.exe PID 284 wrote to memory of 1012 284 notepad.exe ghjkzxijdk.exe PID 1012 wrote to memory of 1160 1012 ghjkzxijdk.exe ghjkzxijdk.exe PID 1012 wrote to memory of 1160 1012 ghjkzxijdk.exe ghjkzxijdk.exe PID 1012 wrote to memory of 1160 1012 ghjkzxijdk.exe ghjkzxijdk.exe PID 1012 wrote to memory of 1160 1012 ghjkzxijdk.exe ghjkzxijdk.exe PID 1012 wrote to memory of 1052 1012 ghjkzxijdk.exe ghjkzxijdk.exe PID 1012 wrote to memory of 1052 1012 ghjkzxijdk.exe ghjkzxijdk.exe PID 1012 wrote to memory of 1052 1012 ghjkzxijdk.exe ghjkzxijdk.exe PID 1012 wrote to memory of 1052 1012 ghjkzxijdk.exe ghjkzxijdk.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious behavior: EnumeratesProcesses 1351 IoCs
Processes:
2885d39472461249eea2d56856ea913a.exeghjkzxijdk.exeghjkzxijdk.exepid process 844 2885d39472461249eea2d56856ea913a.exe 1012 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe 1052 ghjkzxijdk.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ghjkzxijdk.exepid process 1012 ghjkzxijdk.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ghjkzxijdk.exedescription pid process target process PID 1012 set thread context of 1160 1012 ghjkzxijdk.exe ghjkzxijdk.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe:ZoneIdentifier notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
notepad.exepid process 284 notepad.exe 284 notepad.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ghjkzxijdk.exedescription pid process Token: SeDebugPrivilege 1160 ghjkzxijdk.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs notepad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Executes dropped EXE 3 IoCs
Processes:
ghjkzxijdk.exeghjkzxijdk.exeghjkzxijdk.exepid process 1012 ghjkzxijdk.exe 1160 ghjkzxijdk.exe 1052 ghjkzxijdk.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ghjkzxijdk.exepid process 1160 ghjkzxijdk.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
ghjkzxijdk.exepid process 1160 ghjkzxijdk.exe -
Processes:
resource yara_rule behavioral1/memory/1160-7-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1160-7-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1160-11-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1160-11-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1160-13-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1160-13-0x0000000000400000-0x0000000000541000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\2885d39472461249eea2d56856ea913a.exe"C:\Users\Admin\AppData\Local\Temp\2885d39472461249eea2d56856ea913a.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
- Loads dropped DLL
- Drops startup file
-
C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe"C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe"C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe"C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe" 2 1160 1164394⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe
-
C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe
-
C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe
-
C:\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe
-
\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe
-
\Users\Admin\AppData\Roaming\appdata\ghjkzxijdk.exe
-
memory/284-1-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/284-0-0x0000000000000000-mapping.dmp
-
memory/1012-4-0x0000000000000000-mapping.dmp
-
memory/1052-10-0x0000000000000000-mapping.dmp
-
memory/1160-8-0x000000000053FBC0-mapping.dmp
-
memory/1160-11-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1160-13-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1160-7-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1160-14-0x0000000001F60000-0x0000000001FFA000-memory.dmpFilesize
616KB
-
memory/1160-15-0x0000000002072000-0x0000000002073000-memory.dmpFilesize
4KB
-
memory/1160-16-0x0000000000310000-0x00000000003A4000-memory.dmpFilesize
592KB