Analysis
- max time kernel
69s - max time network
147s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:41
General
- Target DHL11-05-2020.exe
- Size 1.1MB
- Sample201109-48422twbae
- SHA256 4b675daa6c54e06962ef1162fd7fe105fe9e76193626ec451dda29081cab3582
Malware Config
Extracted
-
Protocol
ftp
-
Host
desguacespalomino.com
-
Port
21
-
Username
-
Password
?}#4lo1Yiw#Q
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL11-05-2020.exe"C:\Users\Admin\AppData\Local\Temp\DHL11-05-2020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL11-05-2020.exe"C:\Users\Admin\AppData\Local\Temp\DHL11-05-2020.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1928-0-0x0000000000400000-0x0000000000563000-memory.dmp
memory/1928-2-0x0000000000400000-0x0000000000563000-memory.dmp
memory/1928-3-0x0000000000400000-0x0000000000563000-memory.dmp
memory/1928-4-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-5-0x0000000002152000-0x0000000002153000-memory.dmp
memory/1928-6-0x0000000000300000-0x00000000003A0000-memory.dmp
memory/1928-8-0x0000000074810000-0x0000000074EFE000-memory.dmp
memory/1928-11-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-12-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-13-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-14-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-15-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-16-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-17-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-19-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-21-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-20-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-18-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-24-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-23-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-22-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-25-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-27-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-26-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-28-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-29-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-30-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-31-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-32-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-33-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-34-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-35-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-36-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-37-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-39-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-38-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-40-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-41-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-42-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-43-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-44-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-46-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-45-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-47-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-48-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-49-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-50-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-51-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-52-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-53-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-54-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-57-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-56-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-55-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-58-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-59-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-60-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-61-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-62-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-63-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-64-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-65-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-66-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-67-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-68-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-70-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-72-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-74-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-76-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-75-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-73-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-78-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-77-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-71-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-69-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-79-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-80-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-81-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-82-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-83-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-84-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-85-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-87-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-86-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-88-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-89-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-90-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-91-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-92-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-93-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-94-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-95-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-96-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-97-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-98-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-99-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-100-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-101-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-102-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-103-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-104-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-105-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-106-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-107-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-108-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-109-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-110-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-111-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-112-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-113-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-114-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-115-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-116-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-117-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-118-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-120-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-121-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-122-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-123-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-124-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-125-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-126-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-127-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-128-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-129-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-119-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-131-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-132-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-133-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-134-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-135-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-136-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-137-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-138-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-139-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-140-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-141-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-142-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-143-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-144-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-145-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-146-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-130-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-148-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-149-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-150-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-151-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-152-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-153-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-154-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-155-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-156-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-157-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-158-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-147-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-159-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-160-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-161-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-162-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-163-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-164-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-165-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-166-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-167-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-168-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-169-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-171-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-172-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-173-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-174-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-175-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-176-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-177-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-170-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-179-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-180-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-181-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-182-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-183-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-184-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-185-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-186-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-187-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-188-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-189-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-190-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-191-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-192-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-193-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-194-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-195-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-196-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-178-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-197-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-198-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-199-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-200-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-201-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-202-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-203-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-204-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-205-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-206-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-207-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-208-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-209-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-210-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-211-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-212-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-213-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-214-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-215-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-216-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-217-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-218-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-219-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-220-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-221-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-222-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-223-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-225-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-226-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-227-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-228-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-229-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-230-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-231-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-232-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-233-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-234-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-235-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-224-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-237-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-238-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-239-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-240-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-241-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-242-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-243-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-244-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-245-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-236-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-246-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-247-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-248-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-249-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-250-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-251-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-252-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-253-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-254-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-255-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-256-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-257-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-258-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-259-0x0000000000740000-0x00000000007E6000-memory.dmp
memory/1928-260-0x0000000005F40000-0x0000000005F7E000-memory.dmp