Analysis
-
max time kernel
64s -
max time network
102s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 12:18
Static task
static1
Behavioral task
behavioral1
Sample
SORUSTURMA 30.07.20.XLS.exe
Resource
win7
Behavioral task
behavioral2
Sample
SORUSTURMA 30.07.20.XLS.exe
Resource
win10
General
-
Target
SORUSTURMA 30.07.20.XLS.exe
-
Size
1.1MB
-
MD5
2a3545f4dfeba61a015cca0f4598b010
-
SHA1
22cd26b8610a8eefad82a690491052bf8f2b128a
-
SHA256
1b0e17e568860f443d28cd430f26925fbb7bc31ee55e287dd16be90274ed33c9
-
SHA512
131fa817042caaec4c3079dfe7efbbaabb92e90db291226da9d741b8946582f223dc75fa9e32ce5502cc4f1f85ea580258bb616995d0137f7df9086d192d98ba
Malware Config
Extracted
C:\Users\Admin\AppData\Local\480F96756F\Log.txt
masslogger
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exeSORUSTURMA 30.07.20.XLS.exepid process 3104 SORUSTURMA 30.07.20.XLS.exe 3104 SORUSTURMA 30.07.20.XLS.exe 3648 SORUSTURMA 30.07.20.XLS.exe 3648 SORUSTURMA 30.07.20.XLS.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exedescription pid process target process PID 3104 set thread context of 3648 3104 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exedescription pid process Token: SeDebugPrivilege 3648 SORUSTURMA 30.07.20.XLS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 api.ipify.org -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exedescription pid process target process PID 3104 wrote to memory of 3648 3104 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe PID 3104 wrote to memory of 3648 3104 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe PID 3104 wrote to memory of 3648 3104 SORUSTURMA 30.07.20.XLS.exe SORUSTURMA 30.07.20.XLS.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exepid process 3104 SORUSTURMA 30.07.20.XLS.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exepid process 3648 SORUSTURMA 30.07.20.XLS.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SORUSTURMA 30.07.20.XLS.exepid process 3648 SORUSTURMA 30.07.20.XLS.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Processes:
resource yara_rule behavioral2/memory/3648-0-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral2/memory/3648-0-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral2/memory/3648-2-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral2/memory/3648-2-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral2/memory/3648-3-0x0000000000400000-0x000000000059D000-memory.dmp upx behavioral2/memory/3648-3-0x0000000000400000-0x000000000059D000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\SORUSTURMA 30.07.20.XLS.exe"C:\Users\Admin\AppData\Local\Temp\SORUSTURMA 30.07.20.XLS.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\SORUSTURMA 30.07.20.XLS.exe"C:\Users\Admin\AppData\Local\Temp\SORUSTURMA 30.07.20.XLS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3648-0-0x0000000000400000-0x000000000059D000-memory.dmpFilesize
1.6MB
-
memory/3648-1-0x000000000059AF50-mapping.dmp
-
memory/3648-2-0x0000000000400000-0x000000000059D000-memory.dmpFilesize
1.6MB
-
memory/3648-3-0x0000000000400000-0x000000000059D000-memory.dmpFilesize
1.6MB
-
memory/3648-4-0x0000000002470000-0x0000000002534000-memory.dmpFilesize
784KB
-
memory/3648-5-0x0000000000862000-0x0000000000863000-memory.dmpFilesize
4KB