Analysis

  • max time kernel
    59s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02/12/2020, 14:03

General

  • Target

    Vessel Details.exe

  • Size

    1.0MB

  • MD5

    c937e1944545e46b2f249badce1502e5

  • SHA1

    869346420d996877d43d8b316e5d20daf90e2c75

  • SHA256

    2c0c11555412e75e830be16688aba26096a7110a3befefb865ddf5410a89a297

  • SHA512

    4001dbfd7f5437133ef17dc044ffbcf68a2faf857d69aed2b17f9ef2bcb046a897e0b0139e1fc97711139711deea7f5e6d4022adc595a0a3814f6705c5605d89

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    maaig.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    E#T~&wyRgLDa

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.vitracer.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    vm85932754

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vessel Details.exe
    "C:\Users\Admin\AppData\Local\Temp\Vessel Details.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Users\Admin\AppData\Local\Temp\Vessel Details.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1872
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Vessel Details.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2672

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1872-35-0x00000000079F0000-0x00000000079F1000-memory.dmp

    Filesize

    4KB

  • memory/1872-30-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

    Filesize

    4KB

  • memory/1872-29-0x0000000007DD0000-0x0000000007E5D000-memory.dmp

    Filesize

    564KB

  • memory/1872-28-0x0000000007D90000-0x0000000007DC9000-memory.dmp

    Filesize

    228KB

  • memory/1872-22-0x00000000068F0000-0x00000000068F1000-memory.dmp

    Filesize

    4KB

  • memory/1872-20-0x00000000060F0000-0x00000000060F1000-memory.dmp

    Filesize

    4KB

  • memory/1872-15-0x00000000739A0000-0x000000007408E000-memory.dmp

    Filesize

    6.9MB

  • memory/1872-12-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2672-38-0x0000000007050000-0x0000000007051000-memory.dmp

    Filesize

    4KB

  • memory/2672-40-0x0000000007EF0000-0x0000000007EF1000-memory.dmp

    Filesize

    4KB

  • memory/2672-54-0x0000000009110000-0x0000000009111000-memory.dmp

    Filesize

    4KB

  • memory/2672-52-0x0000000009120000-0x0000000009121000-memory.dmp

    Filesize

    4KB

  • memory/2672-51-0x0000000009170000-0x0000000009171000-memory.dmp

    Filesize

    4KB

  • memory/2672-25-0x00000000739A0000-0x000000007408E000-memory.dmp

    Filesize

    6.9MB

  • memory/2672-26-0x0000000004380000-0x0000000004381000-memory.dmp

    Filesize

    4KB

  • memory/2672-27-0x00000000070F0000-0x00000000070F1000-memory.dmp

    Filesize

    4KB

  • memory/2672-50-0x0000000008FB0000-0x0000000008FB1000-memory.dmp

    Filesize

    4KB

  • memory/2672-49-0x0000000008E40000-0x0000000008E41000-memory.dmp

    Filesize

    4KB

  • memory/2672-42-0x0000000008E80000-0x0000000008EB3000-memory.dmp

    Filesize

    204KB

  • memory/2672-34-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

    Filesize

    4KB

  • memory/2672-39-0x00000000080C0000-0x00000000080C1000-memory.dmp

    Filesize

    4KB

  • memory/4076-2-0x00000000739A0000-0x000000007408E000-memory.dmp

    Filesize

    6.9MB

  • memory/4076-3-0x00000000009F0000-0x00000000009F1000-memory.dmp

    Filesize

    4KB

  • memory/4076-11-0x0000000008380000-0x0000000008475000-memory.dmp

    Filesize

    980KB

  • memory/4076-5-0x0000000005890000-0x0000000005891000-memory.dmp

    Filesize

    4KB

  • memory/4076-6-0x0000000005430000-0x0000000005431000-memory.dmp

    Filesize

    4KB

  • memory/4076-7-0x0000000002E50000-0x0000000002E51000-memory.dmp

    Filesize

    4KB

  • memory/4076-8-0x0000000007C20000-0x0000000007C21000-memory.dmp

    Filesize

    4KB

  • memory/4076-9-0x0000000006E30000-0x0000000006E31000-memory.dmp

    Filesize

    4KB

  • memory/4076-10-0x0000000006E20000-0x0000000006E2E000-memory.dmp

    Filesize

    56KB