Analysis
- max time kernel
51s - max time network
104s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:54
General
- Target PO# 2001840394 - NEW ORDER.exe
- Size 1.2MB
- Sample201109-3dkq75rjqa
- SHA256 b88b1caee334cbd27f17d4310f2b51c26a5a9411452ad2f4b7fa17e1e81b59fb
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\CC3AB4D6D6\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.7.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/11/2020 3:03:24 AM MassLogger Started: 11/11/2020 3:03:20 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RegAsm.exe MassLogger Melt: true MassLogger Exit after delivery: false As Administrator: True Processes:
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 2 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO# 2001840394 - NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\PO# 2001840394 - NEW ORDER.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RegAsm.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RegAsm.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-24-0x00000000069A0000-0x00000000069A1000-memory.dmp
memory/636-23-0x0000000006850000-0x0000000006851000-memory.dmp
memory/636-21-0x0000000005630000-0x0000000005631000-memory.dmp
memory/636-20-0x0000000005480000-0x00000000054BE000-memory.dmp
memory/636-19-0x00000000053E0000-0x00000000053E1000-memory.dmp
memory/636-15-0x0000000073210000-0x00000000738FE000-memory.dmp
memory/636-11-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1980-29-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
memory/1980-34-0x00000000082D0000-0x00000000082D1000-memory.dmp
memory/1980-41-0x0000000007560000-0x0000000007561000-memory.dmp
memory/1980-40-0x0000000009AE0000-0x0000000009AE1000-memory.dmp
memory/1980-39-0x0000000009710000-0x0000000009711000-memory.dmp
memory/1980-38-0x000000000A160000-0x000000000A161000-memory.dmp
memory/1980-37-0x00000000089F0000-0x00000000089F1000-memory.dmp
memory/1980-36-0x0000000008C00000-0x0000000008C01000-memory.dmp
memory/1980-35-0x00000000081A0000-0x00000000081A1000-memory.dmp
memory/1980-32-0x00000000081F0000-0x00000000081F1000-memory.dmp
memory/1980-28-0x0000000073350000-0x0000000073A3E000-memory.dmp
memory/1980-30-0x0000000007A50000-0x0000000007A51000-memory.dmp
memory/4756-0-0x00000000732D0000-0x00000000739BE000-memory.dmp
memory/4756-1-0x00000000000C0000-0x00000000000C1000-memory.dmp
memory/4756-10-0x00000000064F0000-0x00000000064F1000-memory.dmp
memory/4756-3-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/4756-4-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/4756-5-0x00000000023C0000-0x00000000023CE000-memory.dmp
memory/4756-6-0x00000000023D0000-0x00000000023D2000-memory.dmp
memory/4756-7-0x0000000004C70000-0x0000000004C72000-memory.dmp
memory/4756-8-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/4756-9-0x0000000004C90000-0x0000000004C92000-memory.dmp