Analysis

  • max time kernel
    18s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    30/11/2020, 20:33

General

  • Target

    Halkbank_Ekstre_20201130_080203_744632.pdf.exe

  • Size

    652KB

  • MD5

    245dc64c936592d8f1638b852ab605c3

  • SHA1

    ce8b04e1e8bcbc7e89b1128337745dc64704fd59

  • SHA256

    3d8976fe6a79ea716fa15a77f0b6e301e1091fa1143cf1d4f558153ae259ab3f

  • SHA512

    902bdc8507d1eec7af5732f8bccd7d0dcaa424a9298c16d6e371d1e85b7ad2a6e4c88542b86e7c199607cd92963c2a6aadd0b5e39e40b3ed1f2eadd21a87b571

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Deletes itself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20201130_080203_744632.pdf.exe'
      2⤵
      • Deletes itself
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2708-19-0x0000000007D30000-0x0000000007D31000-memory.dmp

    Filesize

    4KB

  • memory/2708-20-0x00000000081E0000-0x00000000081E1000-memory.dmp

    Filesize

    4KB

  • memory/2708-25-0x0000000007000000-0x0000000007001000-memory.dmp

    Filesize

    4KB

  • memory/2708-24-0x0000000009560000-0x0000000009561000-memory.dmp

    Filesize

    4KB

  • memory/2708-23-0x0000000009190000-0x0000000009191000-memory.dmp

    Filesize

    4KB

  • memory/2708-22-0x0000000009BE0000-0x0000000009BE1000-memory.dmp

    Filesize

    4KB

  • memory/2708-21-0x0000000008480000-0x0000000008481000-memory.dmp

    Filesize

    4KB

  • memory/2708-13-0x0000000006CB0000-0x0000000006CB1000-memory.dmp

    Filesize

    4KB

  • memory/2708-15-0x00000000073D0000-0x00000000073D1000-memory.dmp

    Filesize

    4KB

  • memory/2708-18-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

    Filesize

    4KB

  • memory/2708-14-0x0000000007470000-0x0000000007471000-memory.dmp

    Filesize

    4KB

  • memory/2708-12-0x0000000073A20000-0x000000007410E000-memory.dmp

    Filesize

    6.9MB

  • memory/2708-16-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

    Filesize

    4KB

  • memory/4076-3-0x00000000009F0000-0x00000000009F1000-memory.dmp

    Filesize

    4KB

  • memory/4076-2-0x00000000739A0000-0x000000007408E000-memory.dmp

    Filesize

    6.9MB

  • memory/4076-10-0x0000000007930000-0x0000000007931000-memory.dmp

    Filesize

    4KB

  • memory/4076-9-0x0000000007620000-0x00000000076B8000-memory.dmp

    Filesize

    608KB

  • memory/4076-8-0x0000000006E00000-0x0000000006E75000-memory.dmp

    Filesize

    468KB

  • memory/4076-7-0x0000000005370000-0x0000000005371000-memory.dmp

    Filesize

    4KB

  • memory/4076-6-0x00000000052C0000-0x00000000052C1000-memory.dmp

    Filesize

    4KB

  • memory/4076-5-0x0000000005890000-0x0000000005891000-memory.dmp

    Filesize

    4KB