Analysis

  • max time kernel
    122s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    01/12/2020, 11:59

General

  • Target

    CHIKWA..exe

  • Size

    20KB

  • MD5

    a2efd1ac34c151a0099342619d5d046f

  • SHA1

    d3c39ff8b425565983aa0277c348e7acb49c0007

  • SHA256

    36a4c21f4c6cc8b615bea7141b510fdd5bbae68ee02b262f8215f88f64cf51f6

  • SHA512

    b6a445a1d43cf529d054dc05a42c01337eb1fc3bfc5d00599ed75266ac3407652e73740a49cd0da77768be6e3caa9d98ce1fec636579ef60a8757f5901a70332

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.banoto.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ban127001

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 4 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe
    "C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 4.828
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1324
      • C:\Windows\SysWOW64\timeout.exe
        timeout 4.828
        3⤵
        • Delays execution with timeout.exe
        PID:1964
    • C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe
      "C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe"
      2⤵
        PID:396
      • C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe
        "C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1504
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Dqzimr_btc.exe'
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1540
          • C:\Users\Admin\AppData\Local\Temp\Dqzimr_btc.exe
            "C:\Users\Admin\AppData\Local\Temp\Dqzimr_btc.exe"
            4⤵
            • Executes dropped EXE
            • Drops startup file
            • Loads dropped DLL
            PID:1648

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1080-2-0x0000000074CF0000-0x00000000753DE000-memory.dmp

      Filesize

      6.9MB

    • memory/1080-7-0x000000000B2C0000-0x000000000B421000-memory.dmp

      Filesize

      1.4MB

    • memory/1080-3-0x0000000000150000-0x0000000000151000-memory.dmp

      Filesize

      4KB

    • memory/1504-20-0x0000000074CF0000-0x00000000753DE000-memory.dmp

      Filesize

      6.9MB

    • memory/1504-25-0x0000000002500000-0x0000000002501000-memory.dmp

      Filesize

      4KB

    • memory/1504-27-0x0000000005240000-0x0000000005241000-memory.dmp

      Filesize

      4KB

    • memory/1504-31-0x0000000006020000-0x0000000006021000-memory.dmp

      Filesize

      4KB

    • memory/1504-36-0x0000000006080000-0x0000000006081000-memory.dmp

      Filesize

      4KB

    • memory/1504-37-0x0000000006170000-0x0000000006171000-memory.dmp

      Filesize

      4KB

    • memory/1504-44-0x0000000006280000-0x0000000006281000-memory.dmp

      Filesize

      4KB

    • memory/1504-52-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

      Filesize

      4KB

    • memory/1504-74-0x0000000006300000-0x0000000006301000-memory.dmp

      Filesize

      4KB

    • memory/1504-75-0x0000000006310000-0x0000000006311000-memory.dmp

      Filesize

      4KB

    • memory/1540-18-0x0000000074CF0000-0x00000000753DE000-memory.dmp

      Filesize

      6.9MB

    • memory/1540-23-0x0000000004880000-0x0000000004881000-memory.dmp

      Filesize

      4KB

    • memory/1540-21-0x0000000000850000-0x0000000000851000-memory.dmp

      Filesize

      4KB

    • memory/1648-66-0x0000000074CF0000-0x00000000753DE000-memory.dmp

      Filesize

      6.9MB

    • memory/1648-69-0x0000000000E70000-0x0000000000E71000-memory.dmp

      Filesize

      4KB

    • memory/1756-12-0x0000000074CF0000-0x00000000753DE000-memory.dmp

      Filesize

      6.9MB

    • memory/1756-8-0x0000000000400000-0x0000000000498000-memory.dmp

      Filesize

      608KB

    • memory/1756-10-0x0000000000400000-0x0000000000498000-memory.dmp

      Filesize

      608KB

    • memory/1756-11-0x0000000000400000-0x0000000000498000-memory.dmp

      Filesize

      608KB

    • memory/1756-19-0x0000000005F00000-0x0000000005F8D000-memory.dmp

      Filesize

      564KB