Analysis
- max time kernel
96s - max time network
97s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:57
General
- Target Erenrcompany.exe
- Size 2.3MB
- Sample201109-2pyqgwj2fj
- SHA256 50ff0aae0a9f7c1fc39e15483e5ebf8235d18c9d9ef2a5bd75a538c0a42e444e
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\AEA604E53D\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/10/2020 4:41:06 AM MassLogger Started: 11/10/2020 4:41:02 AM Interval: 2 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe As Administrator: True
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
Dmacdavid
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Erenrcompany.exe"C:\Users\Admin\AppData\Local\Temp\Erenrcompany.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-0-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/636-1-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/636-3-0x0000000005060000-0x000000000506F000-memory.dmp
memory/636-4-0x0000000005690000-0x0000000005691000-memory.dmp
memory/636-5-0x0000000005180000-0x0000000005182000-memory.dmp
memory/636-6-0x0000000005290000-0x0000000005291000-memory.dmp
memory/636-7-0x00000000053B0000-0x00000000053B2000-memory.dmp
memory/636-8-0x0000000005550000-0x0000000005551000-memory.dmp
memory/636-9-0x0000000005540000-0x0000000005543000-memory.dmp
memory/3008-10-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-12-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/3008-16-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-17-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-18-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-19-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-20-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-22-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-21-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-15-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-24-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-25-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-26-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-27-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-28-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-29-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-30-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-31-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-23-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-32-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-33-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-34-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-35-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-36-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-37-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-38-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-39-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-41-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-40-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-42-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-43-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-45-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-44-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-46-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-47-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-48-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-49-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-51-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-50-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-52-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-53-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-54-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-55-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-56-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-57-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-58-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-59-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-60-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-61-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-62-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-63-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-64-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-65-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-66-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-67-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-68-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-70-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-71-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-72-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-73-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-69-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-74-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-75-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-76-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-77-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-78-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-79-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-80-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-81-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-82-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-83-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-84-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-85-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-86-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-87-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-88-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-90-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-89-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-91-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-92-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-93-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-94-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-95-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-96-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-97-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-98-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-99-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-100-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-101-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-102-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-103-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-104-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-105-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-106-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-107-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-108-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-109-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-110-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-111-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-112-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-113-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-114-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-116-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-115-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-117-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-118-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-119-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-120-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-121-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-122-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-124-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-125-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-126-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-127-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-128-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-129-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-130-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-123-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-132-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-131-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-134-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-135-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-136-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-133-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-137-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-138-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-139-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-140-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-141-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-142-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-143-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-144-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-145-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-146-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-147-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-148-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-149-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-150-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-151-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-152-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-153-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-154-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-155-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-156-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-157-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-158-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-159-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-160-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-161-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-162-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-163-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-164-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-165-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-166-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-167-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-168-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-169-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-170-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-171-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-172-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-173-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-174-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-175-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-176-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-177-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-178-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-179-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-180-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-181-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-182-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-183-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-184-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-186-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-185-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-187-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-188-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-190-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-189-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-191-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-192-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-193-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-194-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-195-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-196-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-197-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-198-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-199-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-200-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-201-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-202-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-203-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-204-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-205-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-206-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-207-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-208-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-209-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-211-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-212-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-213-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-214-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-215-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-216-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-217-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-218-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-219-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-210-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-220-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-221-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-222-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-223-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-224-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-225-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-226-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-227-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-228-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-229-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-230-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-231-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-232-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-233-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-234-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-235-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-237-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-236-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-238-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-239-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-240-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-241-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-242-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-243-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-244-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-245-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-246-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-247-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-248-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-250-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-249-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-251-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-252-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-253-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-254-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-255-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-256-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-257-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-258-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-260-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-261-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-263-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-262-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-259-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-264-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-265-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-266-0x0000000000400000-0x0000000000546000-memory.dmp
memory/3008-269-0x00000000055D0000-0x00000000055D1000-memory.dmp
memory/3008-270-0x00000000062C0000-0x00000000062C1000-memory.dmp
memory/3008-271-0x0000000006600000-0x000000000663E000-memory.dmp
memory/3008-272-0x0000000007020000-0x0000000007021000-memory.dmp
memory/3008-273-0x0000000007110000-0x0000000007111000-memory.dmp