Analysis
- max time kernel
148s - max time network
150s - platform
windows7_x64 - resource
win7v20201028 - submitted
19/11/2020, 06:35
General
- Target PROJECT RFQ.exe
- Size 775KB
- Sample201119-sdjxwv4bva
- SHA256 5b32ffc4c10114b55115da9f2c6e4ee22222f5d305552daf00a287b82d66c9dc
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.porathacorp.com
-
Port
587
-
Username
-
Password
susila@22
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies service 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROJECT RFQ.exe"C:\Users\Admin\AppData\Local\Temp\PROJECT RFQ.exe"1⤵
- Modifies service
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xjUGLzdR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB931.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\PROJECT RFQ.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PROJECT RFQ.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\PROJECT RFQ.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\PROJECT RFQ.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/536-0-0x0000000074360000-0x0000000074A4E000-memory.dmp
memory/536-1-0x0000000000E80000-0x0000000000E81000-memory.dmp
memory/536-3-0x00000000003D0000-0x00000000003E4000-memory.dmp
memory/536-4-0x0000000008100000-0x00000000081AB000-memory.dmp
memory/572-71-0x0000000005880000-0x0000000005881000-memory.dmp
memory/572-70-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/572-60-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/572-59-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/572-57-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
memory/572-58-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/572-56-0x0000000073E50000-0x000000007453E000-memory.dmp
memory/896-20-0x0000000002660000-0x0000000002661000-memory.dmp
memory/896-52-0x0000000006300000-0x0000000006301000-memory.dmp
memory/896-38-0x0000000005650000-0x0000000005651000-memory.dmp
memory/896-37-0x0000000006280000-0x0000000006281000-memory.dmp
memory/896-30-0x0000000006160000-0x0000000006161000-memory.dmp
memory/896-29-0x0000000005780000-0x0000000005781000-memory.dmp
memory/896-24-0x0000000005690000-0x0000000005691000-memory.dmp
memory/896-21-0x0000000005240000-0x0000000005241000-memory.dmp
memory/896-53-0x0000000006310000-0x0000000006311000-memory.dmp
memory/896-15-0x00000000742E0000-0x00000000749CE000-memory.dmp
memory/896-16-0x00000000009D0000-0x00000000009D1000-memory.dmp
memory/896-17-0x0000000004880000-0x0000000004881000-memory.dmp
memory/1648-19-0x0000000005FD0000-0x000000000605D000-memory.dmp
memory/1648-18-0x0000000004FE0000-0x0000000005019000-memory.dmp
memory/1648-11-0x00000000742E0000-0x00000000749CE000-memory.dmp
memory/1648-10-0x0000000000400000-0x0000000000486000-memory.dmp
memory/1648-9-0x0000000000400000-0x0000000000486000-memory.dmp
memory/1648-7-0x0000000000400000-0x0000000000486000-memory.dmp