Analysis

  • max time kernel
    62s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    01/12/2020, 14:20

General

  • Target

    vessel details.exe

  • Size

    1.0MB

  • MD5

    0cc939dccba0be64d2c6dc13e7b55729

  • SHA1

    02d50dfe38ff1bc27d76ba3866d326f0a8777208

  • SHA256

    373ff5729bbb58bba6a9426b0a35c58a921be8b76a3ccf1dd9f99f410af8dddd

  • SHA512

    fff564d60bb71423007d24e3feda6288edf27fc65a1d2f02ffda4b8f9d4f435bd18985c220cd132d7505b234770a1f8eda9e77059884df65b24a955905506ae8

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    maaig.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    E#T~&wyRgLDa

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vessel details.exe
    "C:\Users\Admin\AppData\Local\Temp\vessel details.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\vessel details.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:352
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\vessel details.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3588

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/352-29-0x0000000008620000-0x00000000086AD000-memory.dmp

    Filesize

    564KB

  • memory/352-30-0x0000000008700000-0x0000000008701000-memory.dmp

    Filesize

    4KB

  • memory/352-23-0x0000000007250000-0x0000000007251000-memory.dmp

    Filesize

    4KB

  • memory/352-28-0x0000000008140000-0x0000000008179000-memory.dmp

    Filesize

    228KB

  • memory/352-32-0x0000000008290000-0x0000000008291000-memory.dmp

    Filesize

    4KB

  • memory/352-20-0x0000000006960000-0x0000000006961000-memory.dmp

    Filesize

    4KB

  • memory/352-15-0x0000000073C50000-0x000000007433E000-memory.dmp

    Filesize

    6.9MB

  • memory/352-12-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1304-7-0x0000000004F50000-0x0000000004F51000-memory.dmp

    Filesize

    4KB

  • memory/1304-11-0x0000000006830000-0x0000000006932000-memory.dmp

    Filesize

    1.0MB

  • memory/1304-10-0x0000000005320000-0x000000000532E000-memory.dmp

    Filesize

    56KB

  • memory/1304-9-0x00000000051F0000-0x00000000051F1000-memory.dmp

    Filesize

    4KB

  • memory/1304-8-0x0000000005DD0000-0x0000000005DD1000-memory.dmp

    Filesize

    4KB

  • memory/1304-6-0x0000000004F80000-0x0000000004F81000-memory.dmp

    Filesize

    4KB

  • memory/1304-2-0x0000000073C50000-0x000000007433E000-memory.dmp

    Filesize

    6.9MB

  • memory/1304-5-0x00000000053A0000-0x00000000053A1000-memory.dmp

    Filesize

    4KB

  • memory/1304-3-0x0000000000630000-0x0000000000631000-memory.dmp

    Filesize

    4KB

  • memory/3588-24-0x0000000073C50000-0x000000007433E000-memory.dmp

    Filesize

    6.9MB

  • memory/3588-27-0x0000000007150000-0x0000000007151000-memory.dmp

    Filesize

    4KB

  • memory/3588-26-0x0000000006A00000-0x0000000006A01000-memory.dmp

    Filesize

    4KB

  • memory/3588-33-0x00000000079D0000-0x00000000079D1000-memory.dmp

    Filesize

    4KB

  • memory/3588-36-0x0000000007840000-0x0000000007841000-memory.dmp

    Filesize

    4KB

  • memory/3588-37-0x0000000008200000-0x0000000008201000-memory.dmp

    Filesize

    4KB

  • memory/3588-38-0x0000000008100000-0x0000000008101000-memory.dmp

    Filesize

    4KB

  • memory/3588-40-0x0000000009180000-0x00000000091B3000-memory.dmp

    Filesize

    204KB

  • memory/3588-47-0x0000000008F20000-0x0000000008F21000-memory.dmp

    Filesize

    4KB

  • memory/3588-48-0x00000000092B0000-0x00000000092B1000-memory.dmp

    Filesize

    4KB

  • memory/3588-49-0x0000000009450000-0x0000000009451000-memory.dmp

    Filesize

    4KB

  • memory/3588-50-0x0000000006D20000-0x0000000006D21000-memory.dmp

    Filesize

    4KB

  • memory/3588-52-0x0000000006D10000-0x0000000006D11000-memory.dmp

    Filesize

    4KB