Analysis
-
max time kernel
73s -
max time network
136s -
platform
windows7_x64 -
resource
win7 -
submitted
28-08-2020 05:59
Static task
static1
Behavioral task
behavioral1
Sample
Mehmet_inquiry_00382392_176372.pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
Mehmet_inquiry_00382392_176372.pdf.exe
Resource
win10v200722
General
-
Target
Mehmet_inquiry_00382392_176372.pdf.exe
-
Size
1.3MB
-
MD5
d13df375594402f6b205f37d23a4fddc
-
SHA1
fdec6711f508bb2277f84cb60e8e2bee2353f141
-
SHA256
bd99f6b970cc52ee725dd1b734a440243655a3fbc1e2304a665b29d41477c25b
-
SHA512
e3dad4302fe2161e4dd9a0111565228fab5aff6abc9e7603085520a2604dec9044dce1c283b78d5b9d5536e8812b6ecfe5b0b4c5c013ecd7b6f17430a186ceea
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1620-6-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1620-7-0x000000000048198E-mapping.dmp family_masslogger behavioral1/memory/1620-8-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1620-9-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Mehmet_inquiry_00382392_176372.pdf.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\International\Geo\Nation Mehmet_inquiry_00382392_176372.pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Mehmet_inquiry_00382392_176372.pdf.exedescription pid Process procid_target PID 864 set thread context of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Mehmet_inquiry_00382392_176372.pdf.exepid Process 1620 Mehmet_inquiry_00382392_176372.pdf.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Mehmet_inquiry_00382392_176372.pdf.exepid Process 1620 Mehmet_inquiry_00382392_176372.pdf.exe 1620 Mehmet_inquiry_00382392_176372.pdf.exe 1620 Mehmet_inquiry_00382392_176372.pdf.exe 1620 Mehmet_inquiry_00382392_176372.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Mehmet_inquiry_00382392_176372.pdf.exedescription pid Process Token: SeDebugPrivilege 1620 Mehmet_inquiry_00382392_176372.pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Mehmet_inquiry_00382392_176372.pdf.exepid Process 1620 Mehmet_inquiry_00382392_176372.pdf.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Mehmet_inquiry_00382392_176372.pdf.exedescription pid Process procid_target PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28 PID 864 wrote to memory of 1620 864 Mehmet_inquiry_00382392_176372.pdf.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mehmet_inquiry_00382392_176372.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Mehmet_inquiry_00382392_176372.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\Mehmet_inquiry_00382392_176372.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Mehmet_inquiry_00382392_176372.pdf.exe"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1620
-