Analysis
-
max time kernel
23s -
max time network
114s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28/11/2020, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
1e2b0143e30d4e5af0cfa521ad65c169.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1e2b0143e30d4e5af0cfa521ad65c169.exe
Resource
win10v20201028
General
-
Target
1e2b0143e30d4e5af0cfa521ad65c169.exe
-
Size
583KB
-
MD5
1e2b0143e30d4e5af0cfa521ad65c169
-
SHA1
3bdb4191d641c0a7cb3b1a51bda0e8c50b0e517e
-
SHA256
7ad2fda0cceebf5c2c83f30d7a1d38a25b74726f03099bb1a97371373d4eadcf
-
SHA512
7c59904e76d93c6173f917ad8ffd88eb9ca1f6e221d3c87ffe55a66e86843ac06aad95aaf83159dc95600fd011502dd4b93cf5ef9f5b1b70a89c1b33f24e4b76
Malware Config
Extracted
C:\Users\Admin\AppData\Local\5FADD7138A\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 4 IoCs
resource yara_rule behavioral1/memory/1784-8-0x0000000000400000-0x000000000049A000-memory.dmp family_masslogger behavioral1/memory/1784-9-0x00000000004948CE-mapping.dmp family_masslogger behavioral1/memory/1784-10-0x0000000000400000-0x000000000049A000-memory.dmp family_masslogger behavioral1/memory/1784-11-0x0000000000400000-0x000000000049A000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\International\Geo\Nation 1e2b0143e30d4e5af0cfa521ad65c169.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" 1e2b0143e30d4e5af0cfa521ad65c169.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1740 set thread context of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1784 1e2b0143e30d4e5af0cfa521ad65c169.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1784 1e2b0143e30d4e5af0cfa521ad65c169.exe 1784 1e2b0143e30d4e5af0cfa521ad65c169.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe Token: SeDebugPrivilege 1784 1e2b0143e30d4e5af0cfa521ad65c169.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1784 1e2b0143e30d4e5af0cfa521ad65c169.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29 PID 1740 wrote to memory of 1784 1740 1e2b0143e30d4e5af0cfa521ad65c169.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e2b0143e30d4e5af0cfa521ad65c169.exe"C:\Users\Admin\AppData\Local\Temp\1e2b0143e30d4e5af0cfa521ad65c169.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\1e2b0143e30d4e5af0cfa521ad65c169.exe"C:\Users\Admin\AppData\Local\Temp\1e2b0143e30d4e5af0cfa521ad65c169.exe"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1784
-