Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 08:31
Static task
static1
Behavioral task
behavioral1
Sample
5a93bf319a3a7b471bc75fb02a82118a.exe
Resource
win7
Behavioral task
behavioral2
Sample
5a93bf319a3a7b471bc75fb02a82118a.exe
Resource
win10
General
-
Target
5a93bf319a3a7b471bc75fb02a82118a.exe
-
Size
917KB
-
MD5
5a93bf319a3a7b471bc75fb02a82118a
-
SHA1
e7832129e7600697e6b46346292185ec22a04fc5
-
SHA256
f7df41bb2f648ae746c4663406c0422d1e1cc3668915b127fd7da2b81794f377
-
SHA512
ec4b77fc96bd2483131fb7bca833c4191d4ff5719de948f51b5e6ab110669d9eb08e3828bc588bcb7b5e6d8a1f00d9c20b76ebf18acdd184a05e443ada3cece5
Malware Config
Extracted
C:\Users\Admin\AppData\Local\480F96756F\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
5a93bf319a3a7b471bc75fb02a82118a.exenotepad.exemssfsfself.exedescription pid process target process PID 720 wrote to memory of 1232 720 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 720 wrote to memory of 1232 720 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 720 wrote to memory of 1232 720 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 720 wrote to memory of 1232 720 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 720 wrote to memory of 1232 720 5a93bf319a3a7b471bc75fb02a82118a.exe notepad.exe PID 1232 wrote to memory of 364 1232 notepad.exe mssfsfself.exe PID 1232 wrote to memory of 364 1232 notepad.exe mssfsfself.exe PID 1232 wrote to memory of 364 1232 notepad.exe mssfsfself.exe PID 364 wrote to memory of 3560 364 mssfsfself.exe mssfsfself.exe PID 364 wrote to memory of 3560 364 mssfsfself.exe mssfsfself.exe PID 364 wrote to memory of 3560 364 mssfsfself.exe mssfsfself.exe PID 364 wrote to memory of 3584 364 mssfsfself.exe mssfsfself.exe PID 364 wrote to memory of 3584 364 mssfsfself.exe mssfsfself.exe PID 364 wrote to memory of 3584 364 mssfsfself.exe mssfsfself.exe -
Executes dropped EXE 3 IoCs
Processes:
mssfsfself.exemssfsfself.exemssfsfself.exepid process 364 mssfsfself.exe 3560 mssfsfself.exe 3584 mssfsfself.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
mssfsfself.exepid process 364 mssfsfself.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mssfsfself.exepid process 3560 mssfsfself.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe:ZoneIdentifier notepad.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs notepad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2630 IoCs
Processes:
5a93bf319a3a7b471bc75fb02a82118a.exemssfsfself.exemssfsfself.exepid process 720 5a93bf319a3a7b471bc75fb02a82118a.exe 720 5a93bf319a3a7b471bc75fb02a82118a.exe 364 mssfsfself.exe 364 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe 3584 mssfsfself.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Processes:
resource yara_rule behavioral2/memory/3560-4-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3560-4-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3560-8-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3560-8-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3560-10-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3560-10-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mssfsfself.exedescription pid process target process PID 364 set thread context of 3560 364 mssfsfself.exe mssfsfself.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mssfsfself.exedescription pid process Token: SeDebugPrivilege 3560 mssfsfself.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
mssfsfself.exepid process 3560 mssfsfself.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a93bf319a3a7b471bc75fb02a82118a.exe"C:\Users\Admin\AppData\Local\Temp\5a93bf319a3a7b471bc75fb02a82118a.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
- Drops startup file
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe"C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe" 2 3560 581874⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
C:\Users\Admin\AppData\Roaming\appdata\mssfsfself.exe
-
memory/364-1-0x0000000000000000-mapping.dmp
-
memory/1232-0-0x0000000000000000-mapping.dmp
-
memory/3560-4-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3560-5-0x000000000053F740-mapping.dmp
-
memory/3560-8-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3560-10-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3560-11-0x00000000022D0000-0x000000000236A000-memory.dmpFilesize
616KB
-
memory/3560-12-0x0000000002382000-0x0000000002383000-memory.dmpFilesize
4KB
-
memory/3584-7-0x0000000000000000-mapping.dmp