Analysis
-
max time kernel
26s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-12-2020 08:52
Static task
static1
Behavioral task
behavioral1
Sample
nwamamassloga.scr
Resource
win7v20201028
Behavioral task
behavioral2
Sample
nwamamassloga.scr
Resource
win10v20201028
General
-
Target
nwamamassloga.scr
-
Size
6.0MB
-
MD5
8d3ae4916c4df02016b0ac0e900341e5
-
SHA1
6ccab03ec2c6ecfebc013dd39c84d03742f541e8
-
SHA256
d25be05d2b6dc4275fb36d639f4e3e4598e42b904d0748e0574941cb6899ba51
-
SHA512
8840533d06655949d54e8c7fba6a868c5244744226b574c4d5f25da84caddc4a6543bd7b5a8183278be29d0bdda5f29473a6c652f9d93ce6ad7278da41c2799f
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2292-8-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral2/memory/2292-9-0x0000000000481F6E-mapping.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
nwamamassloga.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation nwamamassloga.scr -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
nwamamassloga.scrdescription pid process target process PID 64 set thread context of 2292 64 nwamamassloga.scr nwamamassloga.scr -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
nwamamassloga.scrpid process 2292 nwamamassloga.scr -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
nwamamassloga.scrpowershell.exepid process 2292 nwamamassloga.scr 2292 nwamamassloga.scr 2292 nwamamassloga.scr 2292 nwamamassloga.scr 1308 powershell.exe 1308 powershell.exe 1308 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
nwamamassloga.scrpowershell.exedescription pid process Token: SeDebugPrivilege 2292 nwamamassloga.scr Token: SeDebugPrivilege 1308 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
nwamamassloga.scrpid process 2292 nwamamassloga.scr -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
nwamamassloga.scrnwamamassloga.scrdescription pid process target process PID 64 wrote to memory of 2292 64 nwamamassloga.scr nwamamassloga.scr PID 64 wrote to memory of 2292 64 nwamamassloga.scr nwamamassloga.scr PID 64 wrote to memory of 2292 64 nwamamassloga.scr nwamamassloga.scr PID 64 wrote to memory of 2292 64 nwamamassloga.scr nwamamassloga.scr PID 64 wrote to memory of 2292 64 nwamamassloga.scr nwamamassloga.scr PID 64 wrote to memory of 2292 64 nwamamassloga.scr nwamamassloga.scr PID 64 wrote to memory of 2292 64 nwamamassloga.scr nwamamassloga.scr PID 64 wrote to memory of 2292 64 nwamamassloga.scr nwamamassloga.scr PID 2292 wrote to memory of 1308 2292 nwamamassloga.scr powershell.exe PID 2292 wrote to memory of 1308 2292 nwamamassloga.scr powershell.exe PID 2292 wrote to memory of 1308 2292 nwamamassloga.scr powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nwamamassloga.scr.logMD5
bca5d9d288a7809c63f2d594cb7c7b94
SHA111689c8a592cd8706f0155b4574488dd872cbd97
SHA256d7a3ed9b26c989e840532a7f0fa21bc508f8fbcb2d37116fade84280f2a865ed
SHA512db30f307e6818573f06f115818476104abfce94f15d9ad11e8163aa3cc19cee4cc3c87c98ef45d5c978b6f166089cc0283e3cc9a5db8359a425c8da7039dae0d
-
memory/64-3-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/64-5-0x0000000005860000-0x00000000058F4000-memory.dmpFilesize
592KB
-
memory/64-6-0x0000000005E00000-0x0000000005E01000-memory.dmpFilesize
4KB
-
memory/64-7-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/64-2-0x0000000073160000-0x000000007384E000-memory.dmpFilesize
6.9MB
-
memory/1308-29-0x0000000008400000-0x0000000008401000-memory.dmpFilesize
4KB
-
memory/1308-30-0x0000000008690000-0x0000000008691000-memory.dmpFilesize
4KB
-
memory/1308-44-0x0000000009910000-0x0000000009911000-memory.dmpFilesize
4KB
-
memory/1308-42-0x0000000009920000-0x0000000009921000-memory.dmpFilesize
4KB
-
memory/1308-41-0x0000000009970000-0x0000000009971000-memory.dmpFilesize
4KB
-
memory/1308-17-0x0000000000000000-mapping.dmp
-
memory/1308-40-0x00000000097B0000-0x00000000097B1000-memory.dmpFilesize
4KB
-
memory/1308-18-0x0000000073170000-0x000000007385E000-memory.dmpFilesize
6.9MB
-
memory/1308-39-0x0000000009640000-0x0000000009641000-memory.dmpFilesize
4KB
-
memory/1308-20-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/1308-23-0x0000000007760000-0x0000000007761000-memory.dmpFilesize
4KB
-
memory/1308-24-0x0000000007640000-0x0000000007641000-memory.dmpFilesize
4KB
-
memory/1308-25-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/1308-27-0x0000000007FF0000-0x0000000007FF1000-memory.dmpFilesize
4KB
-
memory/1308-28-0x0000000007730000-0x0000000007731000-memory.dmpFilesize
4KB
-
memory/1308-32-0x0000000009660000-0x0000000009693000-memory.dmpFilesize
204KB
-
memory/2292-9-0x0000000000481F6E-mapping.dmp
-
memory/2292-8-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/2292-21-0x0000000006FB0000-0x0000000006FB1000-memory.dmpFilesize
4KB
-
memory/2292-19-0x0000000006FC0000-0x0000000006FC1000-memory.dmpFilesize
4KB
-
memory/2292-16-0x00000000067B0000-0x00000000067B1000-memory.dmpFilesize
4KB
-
memory/2292-14-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/2292-11-0x0000000073170000-0x000000007385E000-memory.dmpFilesize
6.9MB