Analysis
- max time kernel
78s - max time network
126s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 16:17
General
- Target PO-40, PO-41 & PO-42.exe
- Size 935KB
- Sample201109-abdevjpkn2
- SHA256 da5de33aa29159ce3331c060ed0da0b17346037aa12960652d67ecc7ba6d44a5
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-40, PO-41 & PO-42.exe"C:\Users\Admin\AppData\Local\Temp\PO-40, PO-41 & PO-42.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nwdQIbPjQucxZD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D03.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\PO-40, PO-41 & PO-42.exe"C:\Users\Admin\AppData\Local\Temp\PO-40, PO-41 & PO-42.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\PO-40, PO-41 & PO-42.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/688-7-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/688-4-0x0000000005100000-0x0000000005101000-memory.dmp
memory/688-5-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/688-6-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/688-3-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/688-8-0x0000000005600000-0x0000000005601000-memory.dmp
memory/688-9-0x0000000004C40000-0x0000000004C4B000-memory.dmp
memory/688-10-0x0000000005DA0000-0x0000000005E58000-memory.dmp
memory/688-11-0x0000000005E60000-0x0000000005EE3000-memory.dmp
memory/688-0-0x0000000073BB0000-0x000000007429E000-memory.dmp
memory/688-1-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2844-17-0x0000000073BB0000-0x000000007429E000-memory.dmp
memory/2844-25-0x0000000006AF0000-0x0000000006AF1000-memory.dmp
memory/2844-14-0x0000000000400000-0x0000000000486000-memory.dmp
memory/2844-22-0x0000000006430000-0x0000000006431000-memory.dmp
memory/4032-31-0x0000000007640000-0x0000000007641000-memory.dmp
memory/4032-34-0x00000000076F0000-0x00000000076F1000-memory.dmp
memory/4032-27-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/4032-29-0x0000000007710000-0x0000000007711000-memory.dmp
memory/4032-30-0x0000000007560000-0x0000000007561000-memory.dmp
memory/4032-33-0x0000000007F40000-0x0000000007F41000-memory.dmp
memory/4032-24-0x0000000073BB0000-0x000000007429E000-memory.dmp
memory/4032-35-0x0000000008810000-0x0000000008811000-memory.dmp
memory/4032-36-0x0000000008630000-0x0000000008631000-memory.dmp
memory/4032-38-0x00000000095B0000-0x00000000095E3000-memory.dmp
memory/4032-45-0x0000000009590000-0x0000000009591000-memory.dmp
memory/4032-46-0x0000000009700000-0x0000000009701000-memory.dmp
memory/4032-47-0x00000000098C0000-0x00000000098C1000-memory.dmp
memory/4032-48-0x00000000071A0000-0x00000000071A1000-memory.dmp
memory/4032-50-0x0000000007190000-0x0000000007191000-memory.dmp