Analysis
- max time kernel
58s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:41
General
- Target DHL11-05-2020.exe
- Size 1.1MB
- Sample201109-48422twbae
- SHA256 4b675daa6c54e06962ef1162fd7fe105fe9e76193626ec451dda29081cab3582
Malware Config
Extracted
-
Protocol
ftp
-
Host
desguacespalomino.com
-
Port
21
-
Username
-
Password
?}#4lo1Yiw#Q
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL11-05-2020.exe"C:\Users\Admin\AppData\Local\Temp\DHL11-05-2020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL11-05-2020.exe"C:\Users\Admin\AppData\Local\Temp\DHL11-05-2020.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1484-0-0x0000000000400000-0x0000000000563000-memory.dmp
memory/1484-2-0x0000000000400000-0x0000000000563000-memory.dmp
memory/1484-3-0x0000000000400000-0x0000000000563000-memory.dmp
memory/1484-4-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-5-0x00000000023F2000-0x00000000023F3000-memory.dmp
memory/1484-6-0x00000000730D0000-0x00000000737BE000-memory.dmp
memory/1484-11-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-12-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-13-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-14-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-10-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-9-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-15-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-16-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-17-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-18-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-19-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-20-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-21-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-23-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-22-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-24-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-25-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-26-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-27-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-28-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-29-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-31-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-30-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-32-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-33-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-34-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-35-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-36-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-37-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-38-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-39-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-40-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-41-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-43-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-45-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-44-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-46-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-47-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-48-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-49-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-50-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-51-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-42-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-52-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-53-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-54-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-56-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-55-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-57-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-58-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-59-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-60-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-62-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-61-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-63-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-64-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-65-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-66-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-67-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-68-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-69-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-70-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-72-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-71-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-73-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-74-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-75-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-76-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-77-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-78-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-79-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-81-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-80-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-82-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-83-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-84-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-85-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-87-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-86-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-88-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-90-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-91-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-89-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-93-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-92-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-94-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-95-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-96-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-97-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-98-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-99-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-100-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-101-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-103-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-102-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-104-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-105-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-107-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-106-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-108-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-109-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-110-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-111-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-112-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-113-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-114-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-115-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-116-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-117-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-118-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-119-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-120-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-121-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-122-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-123-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-126-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-127-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-128-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-125-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-124-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-130-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-129-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-131-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-132-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-133-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-134-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-135-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-136-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-137-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-138-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-139-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-140-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-141-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-142-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-143-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-144-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-145-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-146-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-147-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-148-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-149-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-150-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-151-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-152-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-153-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-154-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-155-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-156-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-157-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-158-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-159-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-160-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-161-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-162-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-163-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-164-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-165-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-166-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-167-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-168-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-169-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-171-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-170-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-172-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-173-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-174-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-175-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-176-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-177-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-178-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-179-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-180-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-181-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-182-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-183-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-184-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-186-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-185-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-187-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-188-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-189-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-191-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-190-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-192-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-193-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-194-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-195-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-196-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-197-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-198-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-199-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-200-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-202-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-201-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-203-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-204-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-205-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-206-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-208-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-207-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-209-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-210-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-211-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-213-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-212-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-214-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-215-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-216-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-217-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-218-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-219-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-220-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-221-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-222-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-223-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-224-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-225-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-226-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-227-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-228-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-229-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-230-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-231-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-232-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-233-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-235-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-236-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-237-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-238-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-239-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-240-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-241-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-242-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-234-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-243-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-245-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-244-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-246-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-247-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-248-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-249-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-250-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-251-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-252-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-253-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-254-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-255-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-256-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-257-0x0000000002400000-0x00000000024A6000-memory.dmp
memory/1484-258-0x0000000004A30000-0x0000000004A31000-memory.dmp
memory/1484-259-0x0000000005580000-0x0000000005581000-memory.dmp
memory/1484-260-0x0000000005740000-0x0000000005741000-memory.dmp
memory/1484-261-0x0000000005FA0000-0x0000000005FA1000-memory.dmp
memory/1484-262-0x00000000061A0000-0x00000000061DE000-memory.dmp
memory/1484-263-0x00000000061E0000-0x00000000061E1000-memory.dmp
memory/1484-264-0x0000000006230000-0x0000000006231000-memory.dmp