Analysis
-
max time kernel
24s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-12-2020 17:12
Static task
static1
Behavioral task
behavioral1
Sample
nwamamassloga.scr
Resource
win7v20201028
Behavioral task
behavioral2
Sample
nwamamassloga.scr
Resource
win10v20201028
General
-
Target
nwamamassloga.scr
-
Size
5.7MB
-
MD5
fc822a19f7929313a6515de8f2570149
-
SHA1
b85459795c58be097e3cb6cbf8d7763c9bece136
-
SHA256
cf25b0ff9d683b638d718b02dcd5cce5bf0f42a121d9794c4048cacf38602940
-
SHA512
769c47ae9c3684f1bbcbc0e4cd4e1d6766f6c6efcbff14277a81b4854e58e4b5df4b001eac5ec6f4b2104ef77f65b206961af9b3d10476f25f09fc10c38f6e1a
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3124-8-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral2/memory/3124-9-0x0000000000481F6E-mapping.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
nwamamassloga.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation nwamamassloga.scr -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
nwamamassloga.scrdescription pid process target process PID 576 set thread context of 3124 576 nwamamassloga.scr nwamamassloga.scr -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
nwamamassloga.scrpid process 3124 nwamamassloga.scr -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
nwamamassloga.scrpowershell.exepid process 3124 nwamamassloga.scr 3124 nwamamassloga.scr 3124 nwamamassloga.scr 3124 nwamamassloga.scr 3728 powershell.exe 3728 powershell.exe 3728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
nwamamassloga.scrpowershell.exedescription pid process Token: SeDebugPrivilege 3124 nwamamassloga.scr Token: SeDebugPrivilege 3728 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
nwamamassloga.scrpid process 3124 nwamamassloga.scr -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
nwamamassloga.scrnwamamassloga.scrdescription pid process target process PID 576 wrote to memory of 3124 576 nwamamassloga.scr nwamamassloga.scr PID 576 wrote to memory of 3124 576 nwamamassloga.scr nwamamassloga.scr PID 576 wrote to memory of 3124 576 nwamamassloga.scr nwamamassloga.scr PID 576 wrote to memory of 3124 576 nwamamassloga.scr nwamamassloga.scr PID 576 wrote to memory of 3124 576 nwamamassloga.scr nwamamassloga.scr PID 576 wrote to memory of 3124 576 nwamamassloga.scr nwamamassloga.scr PID 576 wrote to memory of 3124 576 nwamamassloga.scr nwamamassloga.scr PID 576 wrote to memory of 3124 576 nwamamassloga.scr nwamamassloga.scr PID 3124 wrote to memory of 3728 3124 nwamamassloga.scr powershell.exe PID 3124 wrote to memory of 3728 3124 nwamamassloga.scr powershell.exe PID 3124 wrote to memory of 3728 3124 nwamamassloga.scr powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\nwamamassloga.scr'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nwamamassloga.scr.logMD5
bca5d9d288a7809c63f2d594cb7c7b94
SHA111689c8a592cd8706f0155b4574488dd872cbd97
SHA256d7a3ed9b26c989e840532a7f0fa21bc508f8fbcb2d37116fade84280f2a865ed
SHA512db30f307e6818573f06f115818476104abfce94f15d9ad11e8163aa3cc19cee4cc3c87c98ef45d5c978b6f166089cc0283e3cc9a5db8359a425c8da7039dae0d
-
memory/576-2-0x0000000073560000-0x0000000073C4E000-memory.dmpFilesize
6.9MB
-
memory/576-3-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/576-5-0x0000000002BF0000-0x0000000002C7D000-memory.dmpFilesize
564KB
-
memory/576-6-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/576-7-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/3124-9-0x0000000000481F6E-mapping.dmp
-
memory/3124-8-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3124-11-0x0000000073560000-0x0000000073C4E000-memory.dmpFilesize
6.9MB
-
memory/3124-14-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/3124-16-0x00000000066A0000-0x00000000066A1000-memory.dmpFilesize
4KB
-
memory/3124-21-0x0000000006F60000-0x0000000006F61000-memory.dmpFilesize
4KB
-
memory/3124-19-0x0000000006F90000-0x0000000006F91000-memory.dmpFilesize
4KB
-
memory/3728-20-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/3728-28-0x00000000080E0000-0x00000000080E1000-memory.dmpFilesize
4KB
-
memory/3728-17-0x0000000000000000-mapping.dmp
-
memory/3728-22-0x00000000072B0000-0x00000000072B1000-memory.dmpFilesize
4KB
-
memory/3728-24-0x0000000007960000-0x0000000007961000-memory.dmpFilesize
4KB
-
memory/3728-25-0x0000000007B10000-0x0000000007B11000-memory.dmpFilesize
4KB
-
memory/3728-27-0x0000000007CF0000-0x0000000007CF1000-memory.dmpFilesize
4KB
-
memory/3728-18-0x0000000073560000-0x0000000073C4E000-memory.dmpFilesize
6.9MB
-
memory/3728-29-0x0000000008310000-0x0000000008311000-memory.dmpFilesize
4KB
-
memory/3728-30-0x0000000008410000-0x0000000008411000-memory.dmpFilesize
4KB
-
memory/3728-32-0x0000000009180000-0x00000000091B3000-memory.dmpFilesize
204KB
-
memory/3728-39-0x0000000009160000-0x0000000009161000-memory.dmpFilesize
4KB
-
memory/3728-40-0x00000000092D0000-0x00000000092D1000-memory.dmpFilesize
4KB
-
memory/3728-41-0x00000000096F0000-0x00000000096F1000-memory.dmpFilesize
4KB
-
memory/3728-42-0x0000000009650000-0x0000000009651000-memory.dmpFilesize
4KB
-
memory/3728-44-0x0000000006F80000-0x0000000006F81000-memory.dmpFilesize
4KB