Analysis

  • max time kernel
    118s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    30/11/2020, 20:33

General

  • Target

    Halkbank_Ekstre_20201130_080203_744632.pdf.exe

  • Size

    652KB

  • MD5

    245dc64c936592d8f1638b852ab605c3

  • SHA1

    ce8b04e1e8bcbc7e89b1128337745dc64704fd59

  • SHA256

    3d8976fe6a79ea716fa15a77f0b6e301e1091fa1143cf1d4f558153ae259ab3f

  • SHA512

    902bdc8507d1eec7af5732f8bccd7d0dcaa424a9298c16d6e371d1e85b7ad2a6e4c88542b86e7c199607cd92963c2a6aadd0b5e39e40b3ed1f2eadd21a87b571

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.alfaomegaworld.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ALfa34

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1140
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Onvfyn_pi.exe'
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Users\Admin\AppData\Local\Temp\Onvfyn_pi.exe
        "C:\Users\Admin\AppData\Local\Temp\Onvfyn_pi.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Loads dropped DLL
        PID:956

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/756-9-0x0000000005B30000-0x0000000005B69000-memory.dmp

    Filesize

    228KB

  • memory/756-13-0x0000000008550000-0x00000000085DD000-memory.dmp

    Filesize

    564KB

  • memory/756-6-0x0000000004C60000-0x0000000004CF8000-memory.dmp

    Filesize

    608KB

  • memory/756-2-0x00000000748C0000-0x0000000074FAE000-memory.dmp

    Filesize

    6.9MB

  • memory/756-5-0x0000000004220000-0x0000000004295000-memory.dmp

    Filesize

    468KB

  • memory/756-3-0x00000000009A0000-0x00000000009A1000-memory.dmp

    Filesize

    4KB

  • memory/956-66-0x00000000748C0000-0x0000000074FAE000-memory.dmp

    Filesize

    6.9MB

  • memory/956-67-0x0000000000B10000-0x0000000000B11000-memory.dmp

    Filesize

    4KB

  • memory/1140-37-0x0000000006280000-0x0000000006281000-memory.dmp

    Filesize

    4KB

  • memory/1140-61-0x0000000006310000-0x0000000006311000-memory.dmp

    Filesize

    4KB

  • memory/1140-29-0x00000000060E0000-0x00000000060E1000-memory.dmp

    Filesize

    4KB

  • memory/1140-24-0x0000000005670000-0x0000000005671000-memory.dmp

    Filesize

    4KB

  • memory/1140-44-0x00000000055D0000-0x00000000055D1000-memory.dmp

    Filesize

    4KB

  • memory/1140-20-0x0000000002780000-0x0000000002781000-memory.dmp

    Filesize

    4KB

  • memory/1140-60-0x0000000006300000-0x0000000006301000-memory.dmp

    Filesize

    4KB

  • memory/1140-30-0x00000000061D0000-0x00000000061D1000-memory.dmp

    Filesize

    4KB

  • memory/1140-18-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/1140-16-0x0000000004970000-0x0000000004971000-memory.dmp

    Filesize

    4KB

  • memory/1140-12-0x00000000748C0000-0x0000000074FAE000-memory.dmp

    Filesize

    6.9MB

  • memory/1844-11-0x00000000748C0000-0x0000000074FAE000-memory.dmp

    Filesize

    6.9MB

  • memory/1844-14-0x0000000001E60000-0x0000000001E61000-memory.dmp

    Filesize

    4KB