Analysis
-
max time kernel
72s -
max time network
69s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 06:58
Static task
static1
Behavioral task
behavioral1
Sample
00158007301057500.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
00158007301057500.exe
Resource
win10v20201028
General
-
Target
00158007301057500.exe
-
Size
1.1MB
-
MD5
937c2ad1c58ff52c51ee58c7c2cd0c16
-
SHA1
ee96ef2521dc3adf322d157a14d1354a3f544c3f
-
SHA256
1dc21d30d3202d5885c58439163601b1cde9a0a094129dd8e39f0ed8b7f10953
-
SHA512
f035b6792407cba16c4c851e3ab00e7e4d20e1daeeba5dd472c02b09e96f29a02a8e3e108f80fdf738d564944db565c5ebde7a07dc69cb10c4c7b7412da7449f
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3804-12-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral2/memory/3804-13-0x0000000000481C1E-mapping.dmp family_masslogger -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 512 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
00158007301057500.exedescription pid process target process PID 1112 set thread context of 3804 1112 00158007301057500.exe 00158007301057500.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
00158007301057500.exepowershell.exepid process 3804 00158007301057500.exe 3804 00158007301057500.exe 512 powershell.exe 512 powershell.exe 512 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
00158007301057500.exepowershell.exedescription pid process Token: SeDebugPrivilege 3804 00158007301057500.exe Token: SeDebugPrivilege 512 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
00158007301057500.exe00158007301057500.exedescription pid process target process PID 1112 wrote to memory of 3804 1112 00158007301057500.exe 00158007301057500.exe PID 1112 wrote to memory of 3804 1112 00158007301057500.exe 00158007301057500.exe PID 1112 wrote to memory of 3804 1112 00158007301057500.exe 00158007301057500.exe PID 1112 wrote to memory of 3804 1112 00158007301057500.exe 00158007301057500.exe PID 1112 wrote to memory of 3804 1112 00158007301057500.exe 00158007301057500.exe PID 1112 wrote to memory of 3804 1112 00158007301057500.exe 00158007301057500.exe PID 1112 wrote to memory of 3804 1112 00158007301057500.exe 00158007301057500.exe PID 1112 wrote to memory of 3804 1112 00158007301057500.exe 00158007301057500.exe PID 3804 wrote to memory of 512 3804 00158007301057500.exe powershell.exe PID 3804 wrote to memory of 512 3804 00158007301057500.exe powershell.exe PID 3804 wrote to memory of 512 3804 00158007301057500.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00158007301057500.exe"C:\Users\Admin\AppData\Local\Temp\00158007301057500.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00158007301057500.exe"C:\Users\Admin\AppData\Local\Temp\00158007301057500.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\00158007301057500.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\00158007301057500.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
memory/512-29-0x0000000007680000-0x0000000007681000-memory.dmpFilesize
4KB
-
memory/512-28-0x0000000007750000-0x0000000007751000-memory.dmpFilesize
4KB
-
memory/512-21-0x0000000000000000-mapping.dmp
-
memory/512-34-0x0000000008EE0000-0x0000000008EE1000-memory.dmpFilesize
4KB
-
memory/512-33-0x0000000008AE0000-0x0000000008AE1000-memory.dmpFilesize
4KB
-
memory/512-32-0x0000000009560000-0x0000000009561000-memory.dmpFilesize
4KB
-
memory/512-31-0x0000000007E30000-0x0000000007E31000-memory.dmpFilesize
4KB
-
memory/512-22-0x0000000073310000-0x00000000739FE000-memory.dmpFilesize
6.9MB
-
memory/512-26-0x0000000007510000-0x0000000007511000-memory.dmpFilesize
4KB
-
memory/512-25-0x0000000006D50000-0x0000000006D51000-memory.dmpFilesize
4KB
-
memory/512-24-0x0000000006E00000-0x0000000006E01000-memory.dmpFilesize
4KB
-
memory/512-23-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/512-30-0x0000000007C90000-0x0000000007C91000-memory.dmpFilesize
4KB
-
memory/512-35-0x0000000006990000-0x0000000006991000-memory.dmpFilesize
4KB
-
memory/1112-11-0x00000000063C0000-0x000000000647E000-memory.dmpFilesize
760KB
-
memory/1112-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1112-6-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/1112-5-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/1112-9-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/1112-10-0x0000000005740000-0x0000000005752000-memory.dmpFilesize
72KB
-
memory/1112-2-0x0000000073290000-0x000000007397E000-memory.dmpFilesize
6.9MB
-
memory/1112-8-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/1112-7-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/3804-15-0x0000000073290000-0x000000007397E000-memory.dmpFilesize
6.9MB
-
memory/3804-13-0x0000000000481C1E-mapping.dmp
-
memory/3804-12-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3804-20-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB