Analysis

  • max time kernel
    51s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    30/11/2020, 21:52

General

  • Target

    SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.17989.exe

  • Size

    735KB

  • MD5

    4fe4c85d2319e11340eda19d10139e31

  • SHA1

    69d0dbe78b72b4504df3d0b86c6179102cbae921

  • SHA256

    1e86893e03f2f3bec014fc26e5fabd65fdfa2ddf14111707d0ef20dadf5bcef9

  • SHA512

    cea997ee077c9738032ba1a05ec6dd4a3ff6c5815174c49d9cff9e989bb9872fd7923fbd0d78a9d7cf020bef966f827208473b56f1f8a09e359f793e7a4f2c58

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.17989.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.17989.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.17989.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.17989.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1520-7-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

  • memory/1520-9-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

  • memory/1520-10-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

  • memory/1520-11-0x0000000074090000-0x000000007477E000-memory.dmp

    Filesize

    6.9MB

  • memory/1684-2-0x0000000074110000-0x00000000747FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1684-3-0x0000000000A20000-0x0000000000A21000-memory.dmp

    Filesize

    4KB

  • memory/1684-5-0x0000000005C60000-0x0000000005D04000-memory.dmp

    Filesize

    656KB

  • memory/1684-6-0x0000000000980000-0x0000000000996000-memory.dmp

    Filesize

    88KB