Analysis
-
max time kernel
70s -
max time network
126s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-12-2020 06:16
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_121720.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
RFQ_121720.exe
Resource
win10v20201028
General
-
Target
RFQ_121720.exe
-
Size
1.2MB
-
MD5
3ad67ecbfd9e60db3dbe32de2b834f76
-
SHA1
17d7b06dc1f28408c24e822c0c19153c5170d01d
-
SHA256
30920f99abe5eed123d3da56f24aca831bcc33e8e91548ef4bb3bc265f412fc2
-
SHA512
9adbbe07a5c372cdc08555ef64f93a30845b9b19080a5fd6d53018311dde6c3c281b98871ffa0cedf86fef92a2473c1f8ff9e12428a024ab0ab0b53b891e2c1e
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1068-9-0x0000000008470000-0x00000000084F0000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RFQ_121720.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\International\Geo\Nation RFQ_121720.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
RFQ_121720.exepid process 1068 RFQ_121720.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RFQ_121720.exepowershell.exepid process 1068 RFQ_121720.exe 1068 RFQ_121720.exe 1068 RFQ_121720.exe 1068 RFQ_121720.exe 576 powershell.exe 576 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ_121720.exepowershell.exedescription pid process Token: SeDebugPrivilege 1068 RFQ_121720.exe Token: SeDebugPrivilege 576 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RFQ_121720.exepid process 1068 RFQ_121720.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
RFQ_121720.exedescription pid process target process PID 1068 wrote to memory of 1892 1068 RFQ_121720.exe schtasks.exe PID 1068 wrote to memory of 1892 1068 RFQ_121720.exe schtasks.exe PID 1068 wrote to memory of 1892 1068 RFQ_121720.exe schtasks.exe PID 1068 wrote to memory of 1892 1068 RFQ_121720.exe schtasks.exe PID 1068 wrote to memory of 576 1068 RFQ_121720.exe powershell.exe PID 1068 wrote to memory of 576 1068 RFQ_121720.exe powershell.exe PID 1068 wrote to memory of 576 1068 RFQ_121720.exe powershell.exe PID 1068 wrote to memory of 576 1068 RFQ_121720.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_121720.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_121720.exe"1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nvqewUIaI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE3E9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RFQ_121720.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE3E9.tmpMD5
6bf6b826fcc2e8a6b2a2cb96ea2b309d
SHA19c0db99c8e3eb7f0737f8744cc26c2aeac1ebdfe
SHA256f8542d27f8b9f8323b2d4365ca87038f79640802acf2350562cea387643b3a56
SHA5120de3d99dbc8ac6601c93b3a156bf9741926c34b5a2de7a17e086aff7739b400cad79951e93c8d8bd75c4e8083f065c398874a305e090751909d49f2aced3bddb
-
memory/576-13-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/576-23-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/576-12-0x0000000000DF0000-0x0000000000DF1000-memory.dmpFilesize
4KB
-
memory/576-46-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/576-32-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/576-31-0x0000000006200000-0x0000000006201000-memory.dmpFilesize
4KB
-
memory/576-10-0x0000000000000000-mapping.dmp
-
memory/576-11-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/576-24-0x0000000006130000-0x0000000006131000-memory.dmpFilesize
4KB
-
memory/576-47-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/576-15-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/576-14-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/576-18-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/1068-5-0x00000000004D0000-0x00000000004D4000-memory.dmpFilesize
16KB
-
memory/1068-6-0x0000000005FD0000-0x00000000060BB000-memory.dmpFilesize
940KB
-
memory/1068-9-0x0000000008470000-0x00000000084F0000-memory.dmpFilesize
512KB
-
memory/1068-3-0x0000000000D70000-0x0000000000D71000-memory.dmpFilesize
4KB
-
memory/1068-2-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/1892-7-0x0000000000000000-mapping.dmp