Analysis
- max time kernel
110s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:58
General
- Target 4-5114-HT.exe
- Size 818KB
- Sample201109-47gf4mcv32
- SHA256 81ae80d0dc7e949cd78a6b555c1b08ebd8ec89ecf9847f3d1c0d9790b11be355
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\7C372DB998\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/11/2020 5:22:04 AM MassLogger Started: 11/11/2020 5:21:51 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\4-5114-HT.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 2 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4-5114-HT.exe"C:\Users\Admin\AppData\Local\Temp\4-5114-HT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gHcqgvrO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB9EA.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\4-5114-HT.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/428-0-0x0000000073160000-0x000000007384E000-memory.dmp
memory/428-4-0x0000000002DC0000-0x0000000002DCB000-memory.dmp
memory/428-5-0x0000000005400000-0x0000000005401000-memory.dmp
memory/428-6-0x0000000005BF0000-0x0000000005C99000-memory.dmp
memory/428-7-0x00000000062A0000-0x00000000062A1000-memory.dmp
memory/428-3-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/428-1-0x0000000000A00000-0x0000000000A01000-memory.dmp
memory/1524-13-0x0000000073160000-0x000000007384E000-memory.dmp
memory/1524-10-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1524-18-0x0000000000F10000-0x0000000000F4E000-memory.dmp
memory/1524-19-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/1524-21-0x0000000006A00000-0x0000000006A01000-memory.dmp
memory/1524-22-0x00000000078F0000-0x00000000078F1000-memory.dmp