Analysis
-
max time kernel
122s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02/12/2020, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
52b1565bb8a50701d219f361929ea870.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
52b1565bb8a50701d219f361929ea870.exe
Resource
win10v20201028
General
-
Target
52b1565bb8a50701d219f361929ea870.exe
-
Size
650KB
-
MD5
52b1565bb8a50701d219f361929ea870
-
SHA1
aa6e4ce4342cb755a2fe894288534a04bc23f367
-
SHA256
9b1d91114fdc8c143afbedc2475e69a539c81d19eeee4ba9301da81b794efaf7
-
SHA512
6a9028a90574cb6f6431395697b4a23b7b67cb69738a2d3b29359b7c91a7e93c0c10d8c120699da51bbf9b216d9da75361341749a381ab2ed6036e25237c1106
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 4 IoCs
resource yara_rule behavioral1/memory/1928-16-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1928-17-0x0000000000481ABE-mapping.dmp family_masslogger behavioral1/memory/1928-19-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1928-20-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 52b1565bb8a50701d219f361929ea870.exe -
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
resource yara_rule behavioral1/memory/1168-9-0x0000000000AB0000-0x0000000000B3A000-memory.dmp beds_protector -
Executes dropped EXE 2 IoCs
pid Process 1168 52b1565bb8a50701d219f361929ea870.exe 1928 52b1565bb8a50701d219f361929ea870.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\International\Geo\Nation 52b1565bb8a50701d219f361929ea870.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel.exe 52b1565bb8a50701d219f361929ea870.exe -
Loads dropped DLL 5 IoCs
pid Process 1992 52b1565bb8a50701d219f361929ea870.exe 1992 52b1565bb8a50701d219f361929ea870.exe 1992 52b1565bb8a50701d219f361929ea870.exe 1992 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1168 set thread context of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 -
Drops file in Program Files directory 85 IoCs
description ioc Process File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Temp\GUMCEA4.tmp\GOFB2B~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\Install\{A281F~1\CR_02A57.tmp\setup.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 52b1565bb8a50701d219f361929ea870.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 52b1565bb8a50701d219f361929ea870.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 52b1565bb8a50701d219f361929ea870.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 52b1565bb8a50701d219f361929ea870.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1928 52b1565bb8a50701d219f361929ea870.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1168 52b1565bb8a50701d219f361929ea870.exe 1928 52b1565bb8a50701d219f361929ea870.exe 1928 52b1565bb8a50701d219f361929ea870.exe 1928 52b1565bb8a50701d219f361929ea870.exe 1928 52b1565bb8a50701d219f361929ea870.exe 568 powershell.exe 568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1168 52b1565bb8a50701d219f361929ea870.exe Token: SeDebugPrivilege 1928 52b1565bb8a50701d219f361929ea870.exe Token: SeDebugPrivilege 568 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1928 52b1565bb8a50701d219f361929ea870.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1168 1992 52b1565bb8a50701d219f361929ea870.exe 25 PID 1992 wrote to memory of 1168 1992 52b1565bb8a50701d219f361929ea870.exe 25 PID 1992 wrote to memory of 1168 1992 52b1565bb8a50701d219f361929ea870.exe 25 PID 1992 wrote to memory of 1168 1992 52b1565bb8a50701d219f361929ea870.exe 25 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1168 wrote to memory of 1928 1168 52b1565bb8a50701d219f361929ea870.exe 30 PID 1928 wrote to memory of 568 1928 52b1565bb8a50701d219f361929ea870.exe 32 PID 1928 wrote to memory of 568 1928 52b1565bb8a50701d219f361929ea870.exe 32 PID 1928 wrote to memory of 568 1928 52b1565bb8a50701d219f361929ea870.exe 32 PID 1928 wrote to memory of 568 1928 52b1565bb8a50701d219f361929ea870.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\52b1565bb8a50701d219f361929ea870.exe"C:\Users\Admin\AppData\Local\Temp\52b1565bb8a50701d219f361929ea870.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\52b1565bb8a50701d219f361929ea870.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\52b1565bb8a50701d219f361929ea870.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\52b1565bb8a50701d219f361929ea870.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\52b1565bb8a50701d219f361929ea870.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3582-490\52b1565bb8a50701d219f361929ea870.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
-