Analysis
-
max time kernel
44s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01/12/2020, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
CHIKWA..exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
CHIKWA..exe
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
CHIKWA..exe
-
Size
20KB
-
MD5
a2efd1ac34c151a0099342619d5d046f
-
SHA1
d3c39ff8b425565983aa0277c348e7acb49c0007
-
SHA256
36a4c21f4c6cc8b615bea7141b510fdd5bbae68ee02b262f8215f88f64cf51f6
-
SHA512
b6a445a1d43cf529d054dc05a42c01337eb1fc3bfc5d00599ed75266ac3407652e73740a49cd0da77768be6e3caa9d98ce1fec636579ef60a8757f5901a70332
Score
10/10
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
resource yara_rule behavioral2/memory/3132-10-0x0000000000400000-0x0000000000498000-memory.dmp family_masslogger behavioral2/memory/3132-11-0x000000000049307E-mapping.dmp family_masslogger -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CHIKWA..exe\"" CHIKWA..exe -
Deletes itself 1 IoCs
pid Process 3896 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CHIKWA..exe CHIKWA..exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CHIKWA..exe CHIKWA..exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CHIKWA..exe" CHIKWA..exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\CHIKWA..exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CHIKWA..exe" CHIKWA..exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2432 set thread context of 3132 2432 CHIKWA..exe 81 -
Delays execution with timeout.exe 1 IoCs
pid Process 2828 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3132 CHIKWA..exe 3132 CHIKWA..exe 3896 powershell.exe 3896 powershell.exe 3896 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2432 CHIKWA..exe Token: SeDebugPrivilege 3132 CHIKWA..exe Token: SeDebugPrivilege 3896 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2432 wrote to memory of 728 2432 CHIKWA..exe 75 PID 2432 wrote to memory of 728 2432 CHIKWA..exe 75 PID 2432 wrote to memory of 728 2432 CHIKWA..exe 75 PID 728 wrote to memory of 2828 728 cmd.exe 77 PID 728 wrote to memory of 2828 728 cmd.exe 77 PID 728 wrote to memory of 2828 728 cmd.exe 77 PID 2432 wrote to memory of 3132 2432 CHIKWA..exe 81 PID 2432 wrote to memory of 3132 2432 CHIKWA..exe 81 PID 2432 wrote to memory of 3132 2432 CHIKWA..exe 81 PID 2432 wrote to memory of 3132 2432 CHIKWA..exe 81 PID 2432 wrote to memory of 3132 2432 CHIKWA..exe 81 PID 2432 wrote to memory of 3132 2432 CHIKWA..exe 81 PID 2432 wrote to memory of 3132 2432 CHIKWA..exe 81 PID 2432 wrote to memory of 3132 2432 CHIKWA..exe 81 PID 3132 wrote to memory of 3896 3132 CHIKWA..exe 83 PID 3132 wrote to memory of 3896 3132 CHIKWA..exe 83 PID 3132 wrote to memory of 3896 3132 CHIKWA..exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe"C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.8282⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\timeout.exetimeout 4.8283⤵
- Delays execution with timeout.exe
PID:2828
-
-
-
C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe"C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\CHIKWA..exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-