Analysis
-
max time kernel
96s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-11-2020 08:56
Static task
static1
Behavioral task
behavioral1
Sample
mouse_2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
mouse_2.exe
Resource
win10v20201028
General
-
Target
mouse_2.exe
-
Size
984KB
-
MD5
af8ab92992ccc4cc6a637953836edf93
-
SHA1
ac17c77cae31fdfeb618b0083285ba869baf29fc
-
SHA256
03968a3a5a7a880feefca31686fcfbed445080a0c06eda2b6d623757179b782c
-
SHA512
9dc3bdfe45f9333d62ef3b0aaf3860a9ef1e94ced02ed0437d3ac2f96b3b9aacf6e621703f13d62f356bd50dec84cc3a3dc787a8a14c9ce0ceeed9ff63c45ad2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\5FADD7138A\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1508-143-0x0000000000400000-0x00000000004A8000-memory.dmp family_masslogger behavioral1/memory/1508-144-0x00000000004A2B3E-mapping.dmp family_masslogger behavioral1/memory/1508-145-0x0000000000400000-0x00000000004A8000-memory.dmp family_masslogger behavioral1/memory/1508-146-0x0000000000400000-0x00000000004A8000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Processes:
resource yara_rule behavioral1/memory/1644-137-0x0000000004D20000-0x0000000004DC9000-memory.dmp rezer0 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mouse_2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\International\Geo\Nation mouse_2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mouse_2.exedescription pid process target process PID 1644 set thread context of 1508 1644 mouse_2.exe mouse_2.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
mouse_2.exepid process 1508 mouse_2.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
mouse_2.exemouse_2.exepid process 1644 mouse_2.exe 1644 mouse_2.exe 1644 mouse_2.exe 1508 mouse_2.exe 1508 mouse_2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mouse_2.exemouse_2.exedescription pid process Token: SeDebugPrivilege 1644 mouse_2.exe Token: SeDebugPrivilege 1508 mouse_2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mouse_2.exepid process 1508 mouse_2.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
mouse_2.exedescription pid process target process PID 1644 wrote to memory of 840 1644 mouse_2.exe schtasks.exe PID 1644 wrote to memory of 840 1644 mouse_2.exe schtasks.exe PID 1644 wrote to memory of 840 1644 mouse_2.exe schtasks.exe PID 1644 wrote to memory of 840 1644 mouse_2.exe schtasks.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe PID 1644 wrote to memory of 1508 1644 mouse_2.exe mouse_2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mouse_2.exe"C:\Users\Admin\AppData\Local\Temp\mouse_2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aqkfZm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B88.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\mouse_2.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5B88.tmpMD5
4a2288a6609492f823e86569fb45e186
SHA1e2b3ac2400404930b32d0e11a0eecf91ebe823cd
SHA25698cfe3da0228c2220c4325a17ea9977e9735a3d0da9770677835140559b32e60
SHA51262ff78adb3172899256b8bf0347c72641ea491996c6cd28e676507c7e0dd6f2a14e67c825c85b5789f79554c7632ff015dc8dde726a5d3a611036e599833e6fa
-
memory/840-139-0x0000000000000000-mapping.dmp
-
memory/1508-143-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1508-144-0x00000000004A2B3E-mapping.dmp
-
memory/1508-145-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1508-154-0x00000000004D0000-0x000000000050E000-memory.dmpFilesize
248KB
-
memory/1508-149-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1508-146-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1644-68-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-14-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-8-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-10-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-72-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-74-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-16-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-18-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-20-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-22-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-24-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-26-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-28-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-30-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-32-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-34-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-36-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-38-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-40-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-42-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-44-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-46-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-48-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-50-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-52-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-54-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-56-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-58-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-60-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-62-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-64-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-66-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-4-0x0000000000590000-0x00000000005A1000-memory.dmpFilesize
68KB
-
memory/1644-70-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-76-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-6-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-12-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-78-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-80-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-82-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-84-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-86-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-88-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-90-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-92-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-94-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-96-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-98-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-100-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-102-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-104-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-106-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-108-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-110-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-112-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-114-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-116-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-118-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-120-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-122-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-124-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-126-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-128-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-3-0x0000000004490000-0x000000000454B000-memory.dmpFilesize
748KB
-
memory/1644-130-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-132-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-134-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1644-136-0x0000000000450000-0x0000000000452000-memory.dmpFilesize
8KB
-
memory/1644-137-0x0000000004D20000-0x0000000004DC9000-memory.dmpFilesize
676KB
-
memory/1644-148-0x0000000000610000-0x0000000000640000-memory.dmpFilesize
192KB
-
memory/1644-1-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/1644-0-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB