Analysis
-
max time kernel
60s -
max time network
102s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 12:18
Static task
static1
Behavioral task
behavioral1
Sample
SORUSTURMA 30.07.20.XLS.exe
Resource
win7
Behavioral task
behavioral2
Sample
SORUSTURMA 30.07.20.XLS.exe
Resource
win10
General
-
Target
SORUSTURMA 30.07.20.XLS.exe
-
Size
1.1MB
-
MD5
2a3545f4dfeba61a015cca0f4598b010
-
SHA1
22cd26b8610a8eefad82a690491052bf8f2b128a
-
SHA256
1b0e17e568860f443d28cd430f26925fbb7bc31ee55e287dd16be90274ed33c9
-
SHA512
131fa817042caaec4c3079dfe7efbbaabb92e90db291226da9d741b8946582f223dc75fa9e32ce5502cc4f1f85ea580258bb616995d0137f7df9086d192d98ba
Malware Config
Extracted
C:\Users\Admin\AppData\Local\E2C1E8F1FA\Log.txt
masslogger
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exepid process 744 SORUSTURMA 30.07.20.XLS.exe -
Processes:
resource yara_rule behavioral1/memory/744-0-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral1/memory/744-0-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral1/memory/744-2-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral1/memory/744-2-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral1/memory/744-3-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral1/memory/744-3-0x0000000000400000-0x000000000059D000-memory.dmp upx -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exeSORUSTURMA 30.07.20.XLS.exepid process 1588 SORUSTURMA 30.07.20.XLS.exe 744 SORUSTURMA 30.07.20.XLS.exe 744 SORUSTURMA 30.07.20.XLS.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exedescription pid process target process PID 1588 wrote to memory of 744 1588 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe PID 1588 wrote to memory of 744 1588 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe PID 1588 wrote to memory of 744 1588 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe PID 1588 wrote to memory of 744 1588 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exedescription pid process Token: SeDebugPrivilege 744 SORUSTURMA 30.07.20.XLS.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exepid process 744 SORUSTURMA 30.07.20.XLS.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exepid process 1588 SORUSTURMA 30.07.20.XLS.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exedescription pid process target process PID 1588 set thread context of 744 1588 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SORUSTURMA 30.07.20.XLS.exe"C:\Users\Admin\AppData\Local\Temp\SORUSTURMA 30.07.20.XLS.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\SORUSTURMA 30.07.20.XLS.exe"C:\Users\Admin\AppData\Local\Temp\SORUSTURMA 30.07.20.XLS.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-0-0x0000000000400000-0x000000000059D000-memory.dmpFilesize
1.6MB
-
memory/744-1-0x000000000059AF50-mapping.dmp
-
memory/744-2-0x0000000000400000-0x000000000059D000-memory.dmpFilesize
1.6MB
-
memory/744-3-0x0000000000400000-0x000000000059D000-memory.dmpFilesize
1.6MB
-
memory/744-4-0x0000000001F70000-0x0000000002034000-memory.dmpFilesize
784KB
-
memory/744-5-0x00000000002C2000-0x00000000002C3000-memory.dmpFilesize
4KB
-
memory/744-6-0x0000000001DE0000-0x0000000001E9F000-memory.dmpFilesize
764KB