Analysis

  • max time kernel
    25s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    27/11/2020, 14:10

General

  • Target

    26-11-20_Dhl_Signed_document-pdf.exe

  • Size

    5.3MB

  • MD5

    0ea58048397685461c50d29255cd32ac

  • SHA1

    7ce3ba3cf6b124125b2da19109e9ea0dc48be4b9

  • SHA256

    fba68e2814abacdbe354eb421f5fd731a64cf8410b9ded4e914373a7863c2e99

  • SHA512

    4f923f5205475d4266b24333300ef0dce9dd4c0efe77fea252b97f66e121860e1c350b335fe93286d23d748c7ffb9b08c421bcb490fde915636fba26ca3df541

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26-11-20_Dhl_Signed_document-pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\26-11-20_Dhl_Signed_document-pdf.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/576-2-0x0000000073560000-0x0000000073C4E000-memory.dmp

    Filesize

    6.9MB

  • memory/576-3-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/576-5-0x0000000005120000-0x0000000005121000-memory.dmp

    Filesize

    4KB

  • memory/576-6-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

    Filesize

    4KB

  • memory/576-7-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

    Filesize

    4KB

  • memory/576-8-0x0000000008260000-0x00000000082C3000-memory.dmp

    Filesize

    396KB

  • memory/576-766-0x000000001D5C0000-0x000000001D5C1000-memory.dmp

    Filesize

    4KB

  • memory/576-767-0x000000001D590000-0x000000001D591000-memory.dmp

    Filesize

    4KB

  • memory/576-768-0x000000001D8F0000-0x000000001D976000-memory.dmp

    Filesize

    536KB

  • memory/576-769-0x000000001E6F0000-0x000000001E6F1000-memory.dmp

    Filesize

    4KB

  • memory/576-770-0x000000001EA60000-0x000000001EA61000-memory.dmp

    Filesize

    4KB

  • memory/576-771-0x000000001EC50000-0x000000001EC51000-memory.dmp

    Filesize

    4KB

  • memory/576-772-0x000000001EBC0000-0x000000001EBF9000-memory.dmp

    Filesize

    228KB

  • memory/576-773-0x000000001F4F0000-0x000000001F57D000-memory.dmp

    Filesize

    564KB

  • memory/576-774-0x000000001EC00000-0x000000001EC01000-memory.dmp

    Filesize

    4KB

  • memory/576-775-0x000000001F580000-0x000000001F581000-memory.dmp

    Filesize

    4KB