Analysis
- max time kernel
61s - max time network
122s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:45
General
- Target blesss.exe
- Size 892KB
- Sample201109-b91dlb9k7s
- SHA256 426110407bdba9dfe5a4f6d39d6369c8baf47008d7738765c3eb7d1ee62e3344
Malware Config
Signatures
- CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\blesss.exe"C:\Users\Admin\AppData\Local\Temp\blesss.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnVBFNDWjuaCOG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp34D1.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4200-140-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-144-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-13-0x0000000073900000-0x0000000073FEE000-memory.dmp
memory/4200-270-0x00000000074F0000-0x00000000074F1000-memory.dmp
memory/4200-269-0x0000000007060000-0x000000000709E000-memory.dmp
memory/4200-267-0x0000000005750000-0x0000000005751000-memory.dmp
memory/4200-16-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-17-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-18-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-19-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-20-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-21-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-22-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-23-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-24-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-25-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-26-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-27-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-28-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-29-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-30-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-31-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-32-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-33-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-34-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-35-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-36-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-37-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-38-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-39-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-41-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-142-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-43-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-44-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-45-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-46-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-47-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-48-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-49-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-50-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-51-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-52-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-53-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-54-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-55-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-56-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-57-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-40-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-58-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-59-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-60-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-61-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-62-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-63-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-64-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-65-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-66-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-68-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-67-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-69-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-70-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-71-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-72-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-73-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-74-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-75-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-76-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-77-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-78-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-79-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-80-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-81-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-82-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-83-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-84-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-85-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-86-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-87-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-88-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-89-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-90-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-91-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-92-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-93-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-94-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-95-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-97-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-96-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-98-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-99-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-100-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-101-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-102-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-103-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-104-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-105-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-106-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-107-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-109-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-108-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-110-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-111-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-112-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-113-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-114-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-115-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-116-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-117-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-118-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-119-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-120-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-121-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-122-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-123-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-125-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-124-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-126-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-127-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-129-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-128-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-130-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-131-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-132-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-133-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-134-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-135-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-136-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-137-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-138-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-139-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-143-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-42-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-11-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-141-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-145-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-146-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-147-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-148-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-149-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-150-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-152-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-151-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-154-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-153-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-155-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-156-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-157-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-158-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-159-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-160-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-161-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-163-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-165-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-164-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-162-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-166-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-167-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-168-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-169-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-170-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-171-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-172-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-173-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-174-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-175-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-176-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-177-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-178-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-179-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-180-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-181-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-182-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-183-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-184-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-185-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-187-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-186-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-188-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-189-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-190-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-191-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-192-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-193-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-195-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-194-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-196-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-197-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-198-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-199-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-200-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-201-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-202-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-203-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-204-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-205-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-206-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-207-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-208-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-209-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-210-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-211-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-213-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-214-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-215-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-216-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-217-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-218-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-212-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-219-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-220-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-221-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-222-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-223-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-224-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-225-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-227-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-226-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-228-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-229-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-230-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-231-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-232-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-233-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-234-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-235-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-236-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-237-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-238-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-239-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-240-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-241-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-242-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-243-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-245-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-244-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-246-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-247-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-248-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-249-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-250-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-251-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-252-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-253-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-254-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-255-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-257-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-256-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-258-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-259-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-260-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-261-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-262-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-264-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4200-263-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4680-3-0x0000000005850000-0x0000000005851000-memory.dmp
memory/4680-1-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/4680-0-0x0000000073900000-0x0000000073FEE000-memory.dmp
memory/4680-4-0x0000000005350000-0x0000000005351000-memory.dmp
memory/4680-5-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/4680-6-0x0000000005530000-0x0000000005533000-memory.dmp
memory/4680-7-0x0000000008720000-0x00000000087C8000-memory.dmp
memory/4680-8-0x00000000087D0000-0x00000000087D1000-memory.dmp