Analysis

  • max time kernel
    127s
  • max time network
    130s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    03/12/2020, 08:08

General

  • Target

    vessel details.exe

  • Size

    789KB

  • MD5

    5d6a6b01f67747c89c39dbb8b518b506

  • SHA1

    c2e75814f6f08d5edee2b3776131ddb1cb42d78b

  • SHA256

    72072c06a5fe2aa1ebf6d2d0b8882c1e11565bed693b2cff1be63a228b26886b

  • SHA512

    e799e688ce7c0596bdaaac81eac31c061acef226e37a784d0604bf2a0dd421b90b8962668bdd564bd35fa7f7cb5105d155efc7d342f3ecd1579db9ca724b3335

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    maaig.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    E#T~&wyRgLDa

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.vitracer.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    vm85932754

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vessel details.exe
    "C:\Users\Admin\AppData\Local\Temp\vessel details.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Users\Admin\AppData\Local\Temp\vessel details.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\vessel details.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3176

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/732-11-0x0000000007F00000-0x0000000007FB9000-memory.dmp

    Filesize

    740KB

  • memory/732-3-0x0000000000790000-0x0000000000791000-memory.dmp

    Filesize

    4KB

  • memory/732-6-0x00000000050C0000-0x00000000050C1000-memory.dmp

    Filesize

    4KB

  • memory/732-7-0x00000000050A0000-0x00000000050A1000-memory.dmp

    Filesize

    4KB

  • memory/732-8-0x00000000079D0000-0x00000000079D1000-memory.dmp

    Filesize

    4KB

  • memory/732-9-0x0000000007570000-0x0000000007571000-memory.dmp

    Filesize

    4KB

  • memory/732-10-0x0000000007690000-0x000000000769E000-memory.dmp

    Filesize

    56KB

  • memory/732-2-0x00000000730E0000-0x00000000737CE000-memory.dmp

    Filesize

    6.9MB

  • memory/732-5-0x0000000005520000-0x0000000005521000-memory.dmp

    Filesize

    4KB

  • memory/1940-12-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1940-15-0x00000000730E0000-0x00000000737CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1940-20-0x0000000006040000-0x0000000006041000-memory.dmp

    Filesize

    4KB

  • memory/1940-36-0x0000000007F00000-0x0000000007F01000-memory.dmp

    Filesize

    4KB

  • memory/1940-24-0x0000000006960000-0x0000000006961000-memory.dmp

    Filesize

    4KB

  • memory/1940-28-0x0000000007E10000-0x0000000007E49000-memory.dmp

    Filesize

    228KB

  • memory/1940-30-0x0000000007AC0000-0x0000000007AC1000-memory.dmp

    Filesize

    4KB

  • memory/1940-29-0x0000000007E50000-0x0000000007EDD000-memory.dmp

    Filesize

    564KB

  • memory/3176-23-0x00000000730E0000-0x00000000737CE000-memory.dmp

    Filesize

    6.9MB

  • memory/3176-27-0x0000000007470000-0x0000000007471000-memory.dmp

    Filesize

    4KB

  • memory/3176-26-0x0000000004940000-0x0000000004941000-memory.dmp

    Filesize

    4KB

  • memory/3176-34-0x0000000007C80000-0x0000000007C81000-memory.dmp

    Filesize

    4KB

  • memory/3176-38-0x0000000007CF0000-0x0000000007CF1000-memory.dmp

    Filesize

    4KB

  • memory/3176-39-0x0000000008540000-0x0000000008541000-memory.dmp

    Filesize

    4KB

  • memory/3176-40-0x0000000008470000-0x0000000008471000-memory.dmp

    Filesize

    4KB

  • memory/3176-42-0x0000000009430000-0x0000000009463000-memory.dmp

    Filesize

    204KB

  • memory/3176-49-0x00000000091F0000-0x00000000091F1000-memory.dmp

    Filesize

    4KB

  • memory/3176-50-0x0000000009560000-0x0000000009561000-memory.dmp

    Filesize

    4KB

  • memory/3176-51-0x0000000009720000-0x0000000009721000-memory.dmp

    Filesize

    4KB

  • memory/3176-52-0x0000000007000000-0x0000000007001000-memory.dmp

    Filesize

    4KB

  • memory/3176-54-0x0000000006FF0000-0x0000000006FF1000-memory.dmp

    Filesize

    4KB