Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows10_x64 -
resource
win10 -
submitted
30-08-2020 06:01
Static task
static1
Behavioral task
behavioral1
Sample
60091743pdf.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
60091743pdf.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
60091743pdf.exe
-
Size
1.1MB
-
MD5
c9b3ce0f3c3350621b6df632369a58f8
-
SHA1
ac29d51d75264cad92760259a8b2a4c358516975
-
SHA256
9bf180bb7b3cc0fcc6d01b68e2aa82d2f853e081ec71e34942d875324a2415b4
-
SHA512
96a329657409994e8485ded30d9dce953ee19489ab6242df62a2cade14ea107b328043c7ec7c024c3151370c41a16e12fa3ef3bc5371796d436c723b8a3da690
Score
10/10
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
resource yara_rule behavioral2/memory/2088-13-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral2/memory/2088-14-0x0000000000481C2E-mapping.dmp family_masslogger -
Deletes itself 1 IoCs
pid Process 3708 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2920 set thread context of 2088 2920 60091743pdf.exe 78 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1800 schtasks.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 5c15a575927ed601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2920 60091743pdf.exe 2088 60091743pdf.exe 2088 60091743pdf.exe 3708 powershell.exe 3708 powershell.exe 3708 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 3752 svchost.exe Token: SeCreatePagefilePrivilege 3752 svchost.exe Token: SeDebugPrivilege 2920 60091743pdf.exe Token: SeDebugPrivilege 2088 60091743pdf.exe Token: SeDebugPrivilege 3708 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2920 wrote to memory of 1800 2920 60091743pdf.exe 76 PID 2920 wrote to memory of 1800 2920 60091743pdf.exe 76 PID 2920 wrote to memory of 1800 2920 60091743pdf.exe 76 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2088 wrote to memory of 3708 2088 60091743pdf.exe 80 PID 2088 wrote to memory of 3708 2088 60091743pdf.exe 80 PID 2088 wrote to memory of 3708 2088 60091743pdf.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe"C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nwwFxKnJy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD586.tmp"2⤵
- Creates scheduled task(s)
PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe"C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3752