Analysis
- max time kernel
18s - max time network
115s - platform
windows10_x64 - resource
win10v20201028 - submitted
30/11/2020, 20:33
General
- Target Halkbank_Ekstre_20201130_080203_744632.pdf.exe
- Size 652KB
- Sample201130-ekd5r3yave
- SHA256 3d8976fe6a79ea716fa15a77f0b6e301e1091fa1143cf1d4f558153ae259ab3f
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 1 IoCs
- Deletes itself 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe'2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2708-19-0x0000000007D30000-0x0000000007D31000-memory.dmp
memory/2708-20-0x00000000081E0000-0x00000000081E1000-memory.dmp
memory/2708-25-0x0000000007000000-0x0000000007001000-memory.dmp
memory/2708-24-0x0000000009560000-0x0000000009561000-memory.dmp
memory/2708-23-0x0000000009190000-0x0000000009191000-memory.dmp
memory/2708-22-0x0000000009BE0000-0x0000000009BE1000-memory.dmp
memory/2708-21-0x0000000008480000-0x0000000008481000-memory.dmp
memory/2708-13-0x0000000006CB0000-0x0000000006CB1000-memory.dmp
memory/2708-15-0x00000000073D0000-0x00000000073D1000-memory.dmp
memory/2708-18-0x0000000007DD0000-0x0000000007DD1000-memory.dmp
memory/2708-14-0x0000000007470000-0x0000000007471000-memory.dmp
memory/2708-12-0x0000000073A20000-0x000000007410E000-memory.dmp
memory/2708-16-0x0000000007AA0000-0x0000000007AA1000-memory.dmp
memory/4076-3-0x00000000009F0000-0x00000000009F1000-memory.dmp
memory/4076-2-0x00000000739A0000-0x000000007408E000-memory.dmp
memory/4076-10-0x0000000007930000-0x0000000007931000-memory.dmp
memory/4076-9-0x0000000007620000-0x00000000076B8000-memory.dmp
memory/4076-8-0x0000000006E00000-0x0000000006E75000-memory.dmp
memory/4076-7-0x0000000005370000-0x0000000005371000-memory.dmp
memory/4076-6-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/4076-5-0x0000000005890000-0x0000000005891000-memory.dmp