Analysis

  • max time kernel
    119s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    27/11/2020, 14:10

General

  • Target

    26-11-20_Dhl_Signed_document-pdf.exe

  • Size

    5.3MB

  • MD5

    0ea58048397685461c50d29255cd32ac

  • SHA1

    7ce3ba3cf6b124125b2da19109e9ea0dc48be4b9

  • SHA256

    fba68e2814abacdbe354eb421f5fd731a64cf8410b9ded4e914373a7863c2e99

  • SHA512

    4f923f5205475d4266b24333300ef0dce9dd4c0efe77fea252b97f66e121860e1c350b335fe93286d23d748c7ffb9b08c421bcb490fde915636fba26ca3df541

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26-11-20_Dhl_Signed_document-pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\26-11-20_Dhl_Signed_document-pdf.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1756

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1756-2-0x0000000074360000-0x0000000074A4E000-memory.dmp

    Filesize

    6.9MB

  • memory/1756-3-0x0000000000160000-0x0000000000161000-memory.dmp

    Filesize

    4KB

  • memory/1756-5-0x0000000004200000-0x0000000004263000-memory.dmp

    Filesize

    396KB

  • memory/1756-1047-0x0000000024B60000-0x0000000024BE6000-memory.dmp

    Filesize

    536KB

  • memory/1756-1048-0x0000000025300000-0x0000000025339000-memory.dmp

    Filesize

    228KB

  • memory/1756-1049-0x0000000026250000-0x00000000262DD000-memory.dmp

    Filesize

    564KB