Analysis
- max time kernel
127s - max time network
129s - platform
windows10_x64 - resource
win10v200722 - submitted
14/10/2020, 15:20
General
- Target payment telex.exe
- Size 612KB
- Sample201014-yr8vcybeya
- SHA256 670d2b752c68da68cdfd9d1b2f5a2f994509e563cc7ca3f1049d5503b8f48369
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 1 IoCs
- Deletes itself 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment telex.exe"C:\Users\Admin\AppData\Local\Temp\payment telex.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\payment telex.exe'2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-0-0x0000000073270000-0x000000007395E000-memory.dmp
memory/636-1-0x0000000000650000-0x0000000000651000-memory.dmp
memory/636-3-0x0000000005580000-0x0000000005581000-memory.dmp
memory/636-4-0x0000000005080000-0x00000000050E9000-memory.dmp
memory/636-5-0x0000000005370000-0x00000000053F1000-memory.dmp
memory/636-6-0x0000000005BA0000-0x0000000005BA1000-memory.dmp
memory/636-7-0x0000000005500000-0x0000000005501000-memory.dmp
memory/3620-9-0x00000000732F0000-0x00000000739DE000-memory.dmp
memory/3620-10-0x0000000000E00000-0x0000000000E01000-memory.dmp
memory/3620-11-0x0000000006E00000-0x0000000006E01000-memory.dmp
memory/3620-12-0x0000000006BF0000-0x0000000006BF1000-memory.dmp
memory/3620-13-0x0000000006D90000-0x0000000006D91000-memory.dmp
memory/3620-15-0x00000000076F0000-0x00000000076F1000-memory.dmp
memory/3620-16-0x0000000007650000-0x0000000007651000-memory.dmp
memory/3620-17-0x0000000007E40000-0x0000000007E41000-memory.dmp
memory/3620-18-0x0000000007D90000-0x0000000007D91000-memory.dmp
memory/3620-19-0x00000000094F0000-0x00000000094F1000-memory.dmp
memory/3620-20-0x0000000008A90000-0x0000000008A91000-memory.dmp
memory/3620-21-0x0000000008E70000-0x0000000008E71000-memory.dmp
memory/3620-22-0x0000000006910000-0x0000000006911000-memory.dmp