Analysis
- max time kernel
77s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
30/10/2020, 13:16
General
- Target DHL - Air Way Bill.exe
- Size 97KB
- Sample201030-e9plkw7lse
- SHA256 a9cdbfef9598908dcd196e0ecc0f4a76ab2e4a0952334c7ccfc12d74f1fd7060
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 1 IoCs
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL - Air Way Bill.exe"C:\Users\Admin\AppData\Local\Temp\DHL - Air Way Bill.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\DHL - Air Way Bill.exe'2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/500-0-0x0000000073190000-0x000000007387E000-memory.dmp
memory/500-1-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/500-3-0x0000000001260000-0x0000000001268000-memory.dmp
memory/500-4-0x0000000005D90000-0x0000000005D91000-memory.dmp
memory/500-5-0x0000000006590000-0x0000000006611000-memory.dmp
memory/500-6-0x00000000069E0000-0x00000000069E1000-memory.dmp
memory/500-7-0x0000000006A80000-0x0000000006A81000-memory.dmp
memory/1156-9-0x0000000073210000-0x00000000738FE000-memory.dmp
memory/1156-10-0x0000000001010000-0x0000000001011000-memory.dmp
memory/1156-11-0x0000000006D70000-0x0000000006D71000-memory.dmp
memory/1156-12-0x0000000006B70000-0x0000000006B71000-memory.dmp
memory/1156-13-0x0000000006C10000-0x0000000006C11000-memory.dmp
memory/1156-15-0x0000000007580000-0x0000000007581000-memory.dmp
memory/1156-16-0x00000000074E0000-0x00000000074E1000-memory.dmp
memory/1156-17-0x0000000007E40000-0x0000000007E41000-memory.dmp
memory/1156-18-0x0000000007C10000-0x0000000007C11000-memory.dmp
memory/1156-19-0x0000000009380000-0x0000000009381000-memory.dmp
memory/1156-20-0x0000000008920000-0x0000000008921000-memory.dmp
memory/1156-21-0x0000000008D00000-0x0000000008D01000-memory.dmp
memory/1156-22-0x00000000067C0000-0x00000000067C1000-memory.dmp