Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows10_x64 -
resource
win10 -
submitted
30-08-2020 06:01
Static task
static1
Behavioral task
behavioral1
Sample
60091743pdf.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
60091743pdf.exe
Resource
win10
General
-
Target
60091743pdf.exe
-
Size
1.1MB
-
MD5
c9b3ce0f3c3350621b6df632369a58f8
-
SHA1
ac29d51d75264cad92760259a8b2a4c358516975
-
SHA256
9bf180bb7b3cc0fcc6d01b68e2aa82d2f853e081ec71e34942d875324a2415b4
-
SHA512
96a329657409994e8485ded30d9dce953ee19489ab6242df62a2cade14ea107b328043c7ec7c024c3151370c41a16e12fa3ef3bc5371796d436c723b8a3da690
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2088-13-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral2/memory/2088-14-0x0000000000481C2E-mapping.dmp family_masslogger -
Deletes itself 1 IoCs
Processes:
powershell.exepid Process 3708 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
60091743pdf.exedescription pid Process procid_target PID 2920 set thread context of 2088 2920 60091743pdf.exe 78 -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 5c15a575927ed601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
60091743pdf.exe60091743pdf.exepowershell.exepid Process 2920 60091743pdf.exe 2088 60091743pdf.exe 2088 60091743pdf.exe 3708 powershell.exe 3708 powershell.exe 3708 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
svchost.exe60091743pdf.exe60091743pdf.exepowershell.exedescription pid Process Token: SeShutdownPrivilege 3752 svchost.exe Token: SeCreatePagefilePrivilege 3752 svchost.exe Token: SeDebugPrivilege 2920 60091743pdf.exe Token: SeDebugPrivilege 2088 60091743pdf.exe Token: SeDebugPrivilege 3708 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
60091743pdf.exe60091743pdf.exedescription pid Process procid_target PID 2920 wrote to memory of 1800 2920 60091743pdf.exe 76 PID 2920 wrote to memory of 1800 2920 60091743pdf.exe 76 PID 2920 wrote to memory of 1800 2920 60091743pdf.exe 76 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2920 wrote to memory of 2088 2920 60091743pdf.exe 78 PID 2088 wrote to memory of 3708 2088 60091743pdf.exe 80 PID 2088 wrote to memory of 3708 2088 60091743pdf.exe 80 PID 2088 wrote to memory of 3708 2088 60091743pdf.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe"C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nwwFxKnJy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD586.tmp"2⤵
- Creates scheduled task(s)
PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe"C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\60091743pdf.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
MD5
ffa111c889fa261de2b8190f29cb47a9
SHA11f3bafceee427d88f26f98e25e93af9891fcd7f2
SHA2565994cad85552dae3a83d73d2fb7820164e3b65f6e0a20e6d672a1672bfe697d1
SHA5121dbd698c1dd3c3444cd6d52b2b91b02c9f870380ac34ea5f365cd5e3fa99660ac1d85aee3e64ae5539b2dde769b0cb85ed59bac8f87d1ef2d1d759a4168aabf6