Analysis
- max time kernel
134s - max time network
136s - platform
windows10_x64 - resource
win10v20201028 - submitted
15/12/2020, 02:35
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe
Resource
win10v20201028
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe
- Size 1.8MB
- Sample201215-25hnhh2kce
- SHA256 121f9e2ca94382e2562bf30f1cc946ad1e221246ff5b7271dce48d693ec128e8
- MD5 7ca2be12ff1d93475b123c77186f5121
- SHA1 0c88c06553bc3117a7e6f68adb99f1f820ae912d
- SHA512 9f001624285ba6fc75650806e86780ad548a679407f8b33a03066284af5e22fada85d4f19e730aee441fba5cd1f251efaeca471f7a768c6710e5e7316f6bde96
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.bhavnatutor.com
-
Port
587
-
Username
-
Password
Onyeoba111
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
yara_rule masslogger_log_file -
resource yara_rule behavioral2/files/0x000100000001ab77-298.dat upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe - Loads dropped DLL 1 IoCs
pid Process 2984 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 api.ipify.org - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3584 set thread context of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78 - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2984 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2984 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2984 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2984 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3584 wrote to memory of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78 PID 3584 wrote to memory of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78 PID 3584 wrote to memory of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78 PID 3584 wrote to memory of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78 PID 3584 wrote to memory of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78 PID 3584 wrote to memory of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78 PID 3584 wrote to memory of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78 PID 3584 wrote to memory of 2984 3584 SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Stealer.29660.11031.30587.exe"{path}"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2984
-