Analysis
- max time kernel
144s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/11/2020, 14:55
General
- Target OOLU2115890120.xls.exe
- Size 825KB
- Sample201119-xjwcvya7da
- SHA256 b57a1526a07ff4bb2983638af2db5497f2ac33ca92027bf50dfc365cd85b81a0
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OOLU2115890120.xls.exe"C:\Users\Admin\AppData\Local\Temp\OOLU2115890120.xls.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OOLU2115890120.xls.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC91.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/904-11-0x0000000073360000-0x0000000073A4E000-memory.dmp
memory/904-27-0x0000000009850000-0x0000000009883000-memory.dmp
memory/904-49-0x0000000007650000-0x0000000007651000-memory.dmp
memory/904-47-0x0000000007660000-0x0000000007661000-memory.dmp
memory/904-44-0x0000000009D70000-0x0000000009D71000-memory.dmp
memory/904-12-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
memory/904-13-0x00000000079D0000-0x00000000079D1000-memory.dmp
memory/904-35-0x0000000009A00000-0x0000000009A01000-memory.dmp
memory/904-34-0x0000000009830000-0x0000000009831000-memory.dmp
memory/904-16-0x0000000008040000-0x0000000008041000-memory.dmp
memory/904-25-0x0000000008AA0000-0x0000000008AA1000-memory.dmp
memory/904-17-0x00000000080E0000-0x00000000080E1000-memory.dmp
memory/904-20-0x0000000008410000-0x0000000008411000-memory.dmp
memory/904-24-0x00000000087E0000-0x00000000087E1000-memory.dmp
memory/904-23-0x0000000008330000-0x0000000008331000-memory.dmp
memory/1556-40-0x0000000073360000-0x0000000073A4E000-memory.dmp
memory/1556-56-0x0000000008AE0000-0x0000000008AE1000-memory.dmp
memory/2416-64-0x0000000007420000-0x0000000007421000-memory.dmp
memory/2416-78-0x0000000008C20000-0x0000000008C21000-memory.dmp
memory/2416-67-0x0000000007C40000-0x0000000007C41000-memory.dmp
memory/2416-58-0x0000000073360000-0x0000000073A4E000-memory.dmp
memory/4768-10-0x00000000085B0000-0x00000000085B1000-memory.dmp
memory/4768-5-0x0000000005270000-0x0000000005271000-memory.dmp
memory/4768-0-0x0000000073360000-0x0000000073A4E000-memory.dmp
memory/4768-8-0x0000000008470000-0x0000000008471000-memory.dmp
memory/4768-3-0x0000000005850000-0x0000000005851000-memory.dmp
memory/4768-7-0x0000000008120000-0x00000000081A0000-memory.dmp
memory/4768-6-0x00000000057A0000-0x0000000005801000-memory.dmp
memory/4768-1-0x0000000000820000-0x0000000000821000-memory.dmp
memory/4768-4-0x00000000051C0000-0x00000000051C1000-memory.dmp