Analysis
-
max time kernel
76s -
max time network
127s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
28-08-2020 06:10
Static task
static1
Behavioral task
behavioral1
Sample
order9321t.exe
Resource
win7
Behavioral task
behavioral2
Sample
order9321t.exe
Resource
win10v200722
General
-
Target
order9321t.exe
-
Size
940KB
-
MD5
397c5bbcc75db8567548322417aa05fd
-
SHA1
d65b345c5863550cb7c454eedf2de0e16fbd391e
-
SHA256
72ceeee6538d869e032d33c4cac0b1e51f34b9e32bf1e17f475b5609ddfe0bf8
-
SHA512
85d71264d951cc6d921b3ae29e716d3e21566daca5bd315d46a9778313573677e5e1feb6339e92c41c2b3256544ec6dc66e49ec7f0ecf9f245500599b74b233b
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4024-15-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral2/memory/4024-16-0x000000000048195E-mapping.dmp family_masslogger -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
order9321t.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion order9321t.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion order9321t.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
order9321t.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\International\Geo\Nation order9321t.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
order9321t.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum order9321t.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 order9321t.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
order9321t.exedescription pid Process procid_target PID 3488 set thread context of 4024 3488 order9321t.exe 79 -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = bbbb7725127dd601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
order9321t.exepid Process 4024 order9321t.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
order9321t.exeorder9321t.exepid Process 3488 order9321t.exe 3488 order9321t.exe 3488 order9321t.exe 3488 order9321t.exe 3488 order9321t.exe 4024 order9321t.exe 4024 order9321t.exe 4024 order9321t.exe 4024 order9321t.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
svchost.exeorder9321t.exeorder9321t.exedescription pid Process Token: SeShutdownPrivilege 636 svchost.exe Token: SeCreatePagefilePrivilege 636 svchost.exe Token: SeDebugPrivilege 3488 order9321t.exe Token: SeDebugPrivilege 4024 order9321t.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
order9321t.exepid Process 4024 order9321t.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
order9321t.exedescription pid Process procid_target PID 3488 wrote to memory of 3712 3488 order9321t.exe 76 PID 3488 wrote to memory of 3712 3488 order9321t.exe 76 PID 3488 wrote to memory of 3712 3488 order9321t.exe 76 PID 3488 wrote to memory of 3932 3488 order9321t.exe 78 PID 3488 wrote to memory of 3932 3488 order9321t.exe 78 PID 3488 wrote to memory of 3932 3488 order9321t.exe 78 PID 3488 wrote to memory of 4024 3488 order9321t.exe 79 PID 3488 wrote to memory of 4024 3488 order9321t.exe 79 PID 3488 wrote to memory of 4024 3488 order9321t.exe 79 PID 3488 wrote to memory of 4024 3488 order9321t.exe 79 PID 3488 wrote to memory of 4024 3488 order9321t.exe 79 PID 3488 wrote to memory of 4024 3488 order9321t.exe 79 PID 3488 wrote to memory of 4024 3488 order9321t.exe 79 PID 3488 wrote to memory of 4024 3488 order9321t.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\order9321t.exe"C:\Users\Admin\AppData\Local\Temp\order9321t.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YdvIruZxoLuL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7DCC.tmp"2⤵
- Creates scheduled task(s)
PID:3712
-
-
C:\Users\Admin\AppData\Local\Temp\order9321t.exe"{path}"2⤵PID:3932
-
-
C:\Users\Admin\AppData\Local\Temp\order9321t.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4024
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e0719db30447c6fd83480145a75715ea
SHA139e88d1fe0dfc853dc12da16c1de24bc74b83d2d
SHA256077586cb4e41fb7eb88320be1b34179205d7b75d800793eb184850aa43677ec3
SHA512b28679ad19b322d83a0fa9cdddcb0c147b8c55fbce3195dab1ecf30285e48e7155b5d199c517f152cb2edf041d0ad19b0972456e9281b4d17eda25d5c009fe7d
-
MD5
b67857bdc071ecbf71084b7ddf79950a
SHA13382c71f95723ab348c922142ee82d6d39d4b755
SHA256b6bb33989716bc4625224930d30e28d72ce1149f49241ca892c84fdb762fec31
SHA512b27629954e45d10da549a8a035195d7984f7235fdb4905795826f56dafa5839560ba133214ce96f47979e7ec5a71db38d0f626fc87804172dd22089995ebd644