Analysis
- max time kernel
76s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
06/11/2020, 10:37
General
- Target pmdt2egRhRSrXC1.exe
- Size 1.3MB
- Sample201106-pzffdraw76
- SHA256 09566b43ed2bfc7c75e430da0c041345cc4d91ec7fddb2a3f363d57aaab64437
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pmdt2egRhRSrXC1.exe"C:\Users\Admin\AppData\Local\Temp\pmdt2egRhRSrXC1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OWvIJArlIshi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A19.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\pmdt2egRhRSrXC1.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1108-25-0x0000000007AD0000-0x0000000007B5D000-memory.dmp
memory/1108-24-0x0000000006E80000-0x0000000006EB9000-memory.dmp
memory/1108-21-0x0000000006CF0000-0x0000000006CF1000-memory.dmp
memory/1108-20-0x00000000064D0000-0x00000000064D1000-memory.dmp
memory/1108-15-0x0000000073360000-0x0000000073A4E000-memory.dmp
memory/1108-12-0x0000000000400000-0x0000000000486000-memory.dmp
memory/4768-5-0x0000000007680000-0x0000000007681000-memory.dmp
memory/4768-9-0x000000000A460000-0x000000000A461000-memory.dmp
memory/4768-8-0x0000000009D00000-0x0000000009DFC000-memory.dmp
memory/4768-7-0x0000000009250000-0x0000000009266000-memory.dmp
memory/4768-6-0x0000000009E90000-0x0000000009E91000-memory.dmp
memory/4768-0-0x0000000073360000-0x0000000073A4E000-memory.dmp
memory/4768-4-0x00000000076B0000-0x00000000076B1000-memory.dmp
memory/4768-3-0x0000000007AD0000-0x0000000007AD1000-memory.dmp
memory/4768-1-0x0000000000820000-0x0000000000821000-memory.dmp