Analysis
- max time kernel
74s - max time network
124s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/11/2020, 07:20
General
- Target Machine drawing.exe
- Size 1.2MB
- Sample201119-tba7de3ebn
- SHA256 0728fd4058762cdab5e5366f0e353fc86437707048e0a5a915a1d2c433a67c7c
Malware Config
Extracted
-
Protocol
smtp
-
Host
bh-58.webhostbox.net
-
Port
587
-
Username
-
Password
7213575aceACE@#
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Machine drawing.exe"C:\Users\Admin\AppData\Local\Temp\Machine drawing.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Machine drawing.exe"C:\Users\Admin\AppData\Local\Temp\Machine drawing.exe"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Machine drawing.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2484-19-0x0000000006D10000-0x0000000006D49000-memory.dmp
memory/2484-21-0x0000000007950000-0x00000000079DD000-memory.dmp
memory/2484-18-0x0000000006D70000-0x0000000006D71000-memory.dmp
memory/2484-5-0x0000000000400000-0x0000000000486000-memory.dmp
memory/2484-16-0x0000000006C00000-0x0000000006C01000-memory.dmp
memory/2484-8-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/2484-11-0x0000000005560000-0x0000000005561000-memory.dmp
memory/2484-12-0x0000000005B00000-0x0000000005B01000-memory.dmp
memory/2484-13-0x0000000006370000-0x0000000006371000-memory.dmp
memory/2484-15-0x0000000006C50000-0x0000000006C51000-memory.dmp
memory/3228-26-0x0000000007950000-0x0000000007951000-memory.dmp
memory/3228-29-0x0000000007F40000-0x0000000007F41000-memory.dmp
memory/3228-43-0x0000000009150000-0x0000000009151000-memory.dmp
memory/3228-41-0x0000000009160000-0x0000000009161000-memory.dmp
memory/3228-17-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/3228-22-0x0000000006FF0000-0x0000000006FF1000-memory.dmp
memory/3228-20-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/3228-40-0x00000000091B0000-0x00000000091B1000-memory.dmp
memory/3228-39-0x0000000008E00000-0x0000000008E01000-memory.dmp
memory/3228-28-0x00000000078D0000-0x00000000078D1000-memory.dmp
memory/3228-24-0x0000000007690000-0x0000000007691000-memory.dmp
memory/3228-27-0x0000000007700000-0x0000000007701000-memory.dmp
memory/3228-23-0x0000000006E40000-0x0000000006E41000-memory.dmp
memory/3228-31-0x0000000008CD0000-0x0000000008D03000-memory.dmp
memory/3228-38-0x0000000008C90000-0x0000000008C91000-memory.dmp
memory/3980-1-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/3980-0-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/3980-3-0x0000000005D00000-0x0000000005D90000-memory.dmp
memory/3980-4-0x00000000033A0000-0x00000000033B6000-memory.dmp