Analysis
-
max time kernel
110s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03/12/2020, 13:29
Static task
static1
Behavioral task
behavioral1
Sample
IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe
Resource
win10v20201028
General
-
Target
IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe
-
Size
1.1MB
-
MD5
3622e05ed8fed75a31eae667a21e4050
-
SHA1
61d86df4b3d5d0e2905a79fa318dcbcbf39b5bfa
-
SHA256
216650e16b03a9755838309935b714f8b01daf2273f97af0b33887000289c862
-
SHA512
9b70a519c804a13fb434fdca1f47ad3c1ef2263dea0eb1e8d2b3a3cd0914946a155a23a3fa7e7b4ed72451774dd9ce65f931236de5d1c8161a29eaec4f2383e6
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 7 IoCs
resource yara_rule behavioral2/memory/508-14-0x0000000000400000-0x000000000048C000-memory.dmp family_masslogger behavioral2/memory/508-15-0x00000000004876DE-mapping.dmp family_masslogger behavioral2/memory/508-22-0x00000000004876DE-mapping.dmp family_masslogger behavioral2/memory/508-21-0x00000000004876DE-mapping.dmp family_masslogger behavioral2/memory/508-23-0x00000000004876DE-mapping.dmp family_masslogger behavioral2/memory/508-25-0x00000000004876DE-mapping.dmp family_masslogger behavioral2/memory/508-24-0x00000000004876DE-mapping.dmp family_masslogger -
ServiceHost packer 5 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/508-22-0x00000000004876DE-mapping.dmp servicehost behavioral2/memory/508-21-0x00000000004876DE-mapping.dmp servicehost behavioral2/memory/508-23-0x00000000004876DE-mapping.dmp servicehost behavioral2/memory/508-25-0x00000000004876DE-mapping.dmp servicehost behavioral2/memory/508-24-0x00000000004876DE-mapping.dmp servicehost -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 576 set thread context of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78 -
Program crash 1 IoCs
pid pid_target Process procid_target 3976 508 WerFault.exe 78 -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3976 WerFault.exe Token: SeBackupPrivilege 3976 WerFault.exe Token: SeDebugPrivilege 3976 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 576 wrote to memory of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78 PID 576 wrote to memory of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78 PID 576 wrote to memory of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78 PID 576 wrote to memory of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78 PID 576 wrote to memory of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78 PID 576 wrote to memory of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78 PID 576 wrote to memory of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78 PID 576 wrote to memory of 508 576 IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe"C:\Users\Admin\AppData\Local\Temp\IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe"C:\Users\Admin\AppData\Local\Temp\IWZQ4WsDqXVYODCZNbcU_LAdryJz_XrwsziHAAKJyGI.bin.exe"2⤵PID:508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 9403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-