Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 08:31
Static task
static1
Behavioral task
behavioral1
Sample
5a93bf319a3a7b471bc75fb02a82118a.exe
Resource
win7
Behavioral task
behavioral2
Sample
5a93bf319a3a7b471bc75fb02a82118a.exe
Resource
win10
General
-
Target
5a93bf319a3a7b471bc75fb02a82118a.exe
-
Size
917KB
-
MD5
5a93bf319a3a7b471bc75fb02a82118a
-
SHA1
e7832129e7600697e6b46346292185ec22a04fc5
-
SHA256
f7df41bb2f648ae746c4663406c0422d1e1cc3668915b127fd7da2b81794f377
-
SHA512
ec4b77fc96bd2483131fb7bca833c4191d4ff5719de948f51b5e6ab110669d9eb08e3828bc588bcb7b5e6d8a1f00d9c20b76ebf18acdd184a05e443ada3cece5
Malware Config
Extracted
C:\Users\Admin\AppData\Local\E2C1E8F1FA\Log.txt
masslogger
Signatures
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
mssfsfself.exepid process 1424 mssfsfself.exe -
Suspicious behavior: EnumeratesProcesses 1372 IoCs
Processes:
5a93bf319a3a7b471bc75fb02a82118a.exemssfsfself.exemssfsfself.exepid process 1344 5a93bf319a3a7b471bc75fb02a82118a.exe 1424 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe 1000 mssfsfself.exe -
Executes dropped EXE 3 IoCs
Processes:
mssfsfself.exemssfsfself.exemssfsfself.exepid process 1424 mssfsfself.exe 1512 mssfsfself.exe 1000 mssfsfself.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mssfsfself.exedescription pid process Token: SeDebugPrivilege 1512 mssfsfself.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mssfsfself.exepid process 1512 mssfsfself.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
mssfsfself.exepid process 1512 mssfsfself.exe -
Processes:
resource yara_rule behavioral1/memory/1512-7-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1512-7-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1512-11-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1512-11-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1512-13-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/1512-13-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
5a93bf319a3a7b471bc75fb02a82118a.exenotepad.exemssfsfself.exedescription pid process target process PID 1344 wrote to memory of 316 1344 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 1344 wrote to memory of 316 1344 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 1344 wrote to memory of 316 1344 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 1344 wrote to memory of 316 1344 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 1344 wrote to memory of 316 1344 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 1344 wrote to memory of 316 1344 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 316 wrote to memory of 1424 316 notepad.exe mssfsfself.exe PID 316 wrote to memory of 1424 316 notepad.exe mssfsfself.exe PID 316 wrote to memory of 1424 316 notepad.exe mssfsfself.exe PID 316 wrote to memory of 1424 316 notepad.exe mssfsfself.exe PID 1424 wrote to memory of 1512 1424 mssfsfself.exe mssfsfself.exe PID 1424 wrote to memory of 1512 1424 mssfsfself.exe mssfsfself.exe PID 1424 wrote to memory of 1512 1424 mssfsfself.exe mssfsfself.exe PID 1424 wrote to memory of 1512 1424 mssfsfself.exe mssfsfself.exe PID 1424 wrote to memory of 1000 1424 mssfsfself.exe mssfsfself.exe PID 1424 wrote to memory of 1000 1424 mssfsfself.exe mssfsfself.exe PID 1424 wrote to memory of 1000 1424 mssfsfself.exe mssfsfself.exe PID 1424 wrote to memory of 1000 1424 mssfsfself.exe mssfsfself.exe -
Loads dropped DLL 2 IoCs
Processes:
notepad.exepid process 316 notepad.exe 316 notepad.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe:ZoneIdentifier notepad.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs notepad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
mssfsfself.exedescription pid process target process PID 1424 set thread context of 1512 1424 mssfsfself.exe mssfsfself.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a93bf319a3a7b471bc75fb02a82118a.exe"C:\Users\Admin\AppData\Local\Temp\5a93bf319a3a7b471bc75fb02a82118a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- NTFS ADS
- Drops startup file
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe" 2 1512 654894⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
memory/316-1-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/316-0-0x0000000000000000-mapping.dmp
-
memory/1000-10-0x0000000000000000-mapping.dmp
-
memory/1424-4-0x0000000000000000-mapping.dmp
-
memory/1512-8-0x000000000053F740-mapping.dmp
-
memory/1512-11-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1512-7-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1512-13-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/1512-14-0x0000000001E50000-0x0000000001EEA000-memory.dmpFilesize
616KB
-
memory/1512-15-0x00000000001D2000-0x00000000001D3000-memory.dmpFilesize
4KB
-
memory/1512-16-0x0000000000550000-0x00000000005E3000-memory.dmpFilesize
588KB