Analysis

  • max time kernel
    58s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02/12/2020, 14:02

General

  • Target

    Vessel Details.exe

  • Size

    1.0MB

  • MD5

    c937e1944545e46b2f249badce1502e5

  • SHA1

    869346420d996877d43d8b316e5d20daf90e2c75

  • SHA256

    2c0c11555412e75e830be16688aba26096a7110a3befefb865ddf5410a89a297

  • SHA512

    4001dbfd7f5437133ef17dc044ffbcf68a2faf857d69aed2b17f9ef2bcb046a897e0b0139e1fc97711139711deea7f5e6d4022adc595a0a3814f6705c5605d89

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    maaig.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    E#T~&wyRgLDa

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vessel Details.exe
    "C:\Users\Admin\AppData\Local\Temp\Vessel Details.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\Vessel Details.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Vessel Details.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3444

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1028-11-0x00000000078F0000-0x00000000079E5000-memory.dmp

    Filesize

    980KB

  • memory/1028-3-0x0000000000040000-0x0000000000041000-memory.dmp

    Filesize

    4KB

  • memory/1028-6-0x00000000049A0000-0x00000000049A1000-memory.dmp

    Filesize

    4KB

  • memory/1028-7-0x0000000004990000-0x0000000004991000-memory.dmp

    Filesize

    4KB

  • memory/1028-8-0x00000000072C0000-0x00000000072C1000-memory.dmp

    Filesize

    4KB

  • memory/1028-9-0x0000000006D90000-0x0000000006D91000-memory.dmp

    Filesize

    4KB

  • memory/1028-10-0x0000000006E70000-0x0000000006E7E000-memory.dmp

    Filesize

    56KB

  • memory/1028-2-0x0000000073EE0000-0x00000000745CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1028-5-0x0000000004E00000-0x0000000004E01000-memory.dmp

    Filesize

    4KB

  • memory/2788-12-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2788-15-0x0000000073EE0000-0x00000000745CE000-memory.dmp

    Filesize

    6.9MB

  • memory/2788-20-0x00000000061C0000-0x00000000061C1000-memory.dmp

    Filesize

    4KB

  • memory/2788-36-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

    Filesize

    4KB

  • memory/2788-23-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

    Filesize

    4KB

  • memory/2788-28-0x0000000007FD0000-0x0000000008009000-memory.dmp

    Filesize

    228KB

  • memory/2788-30-0x00000000080D0000-0x00000000080D1000-memory.dmp

    Filesize

    4KB

  • memory/2788-29-0x0000000008010000-0x000000000809D000-memory.dmp

    Filesize

    564KB

  • memory/3444-25-0x0000000073EE0000-0x00000000745CE000-memory.dmp

    Filesize

    6.9MB

  • memory/3444-27-0x0000000007870000-0x0000000007871000-memory.dmp

    Filesize

    4KB

  • memory/3444-26-0x0000000004D20000-0x0000000004D21000-memory.dmp

    Filesize

    4KB

  • memory/3444-34-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

    Filesize

    4KB

  • memory/3444-38-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

    Filesize

    4KB

  • memory/3444-39-0x0000000008870000-0x0000000008871000-memory.dmp

    Filesize

    4KB

  • memory/3444-40-0x00000000088C0000-0x00000000088C1000-memory.dmp

    Filesize

    4KB

  • memory/3444-42-0x00000000097E0000-0x0000000009813000-memory.dmp

    Filesize

    204KB

  • memory/3444-49-0x00000000095A0000-0x00000000095A1000-memory.dmp

    Filesize

    4KB

  • memory/3444-50-0x0000000009910000-0x0000000009911000-memory.dmp

    Filesize

    4KB

  • memory/3444-51-0x0000000009AD0000-0x0000000009AD1000-memory.dmp

    Filesize

    4KB

  • memory/3444-52-0x0000000009A80000-0x0000000009A81000-memory.dmp

    Filesize

    4KB

  • memory/3444-54-0x0000000009A70000-0x0000000009A71000-memory.dmp

    Filesize

    4KB