a310logger | 444482bde8f2bb85add3dc622db0c1a7a6974a78be2039ee8d08cc32af48f951

General

Target

OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe
Size

1.0MB
MD5

014ab849062b35196cef62addaa5335a
SHA1

cc7ea1ca876a4ef7d6b2e58b1175fa3816e54ed5
SHA256

444482bde8f2bb85add3dc622db0c1a7a6974a78be2039ee8d08cc32af48f951
SHA512

fc73eddd6a4aaebea9421e9b848a7b890c3d7e5fd7708a743d479648e5ec6d43be45baf1ab641dba0ad531e5a3021d4a445fa26f1e982d58df5f206fa0b09902

Score

10^/10

a310logger stormkitty spyware stealer

Malware Config

Signatures

A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware a310logger
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00030000000130d2-74.dat	family_stormkitty
behavioral1/files/0x00030000000130d2-76.dat	family_stormkitty
behavioral1/files/0x00030000000130d2-77.dat	family_stormkitty

A310logger Executable 3 IoCs

resource	yara_rule
behavioral1/files/0x00030000000130d2-74.dat	a310logger
behavioral1/files/0x00030000000130d2-76.dat	a310logger
behavioral1/files/0x00030000000130d2-77.dat	a310logger

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1692	PASSWORDSNET4.exe

Loads dropped DLL 1 IoCs

pid	Process
928	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	PASSWORDSNET4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PASSWORDSNET4.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
928	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe
1468	AcroRd32.exe
1468	AcroRd32.exe
1468	AcroRd32.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1788	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	29
PID 1988 wrote to memory of 1788	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	29
PID 1988 wrote to memory of 1788	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	29
PID 1988 wrote to memory of 1788	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	29
PID 1988 wrote to memory of 1788	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	29
PID 1988 wrote to memory of 1788	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	29
PID 1988 wrote to memory of 1788	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	29
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 1988 wrote to memory of 928	1988	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	30
PID 928 wrote to memory of 1692	928	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	31
PID 928 wrote to memory of 1692	928	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	31
PID 928 wrote to memory of 1692	928	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	31
PID 928 wrote to memory of 1692	928	OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe	31
PID 1788 wrote to memory of 1468	1788	rundll32.exe	33
PID 1788 wrote to memory of 1468	1788	rundll32.exe	33
PID 1788 wrote to memory of 1468	1788	rundll32.exe	33
PID 1788 wrote to memory of 1468	1788	rundll32.exe	33

C:\Users\Admin\AppData\Local\Temp\OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe
"C:\Users\Admin\AppData\Local\Temp\OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Regazm
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Regazm"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1468
- C:\Users\Admin\AppData\Local\Temp\OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe
  "C:\Users\Admin\AppData\Local\Temp\OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-66-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/928-73-0x00000000007B0000-0x00000000007B2000-memory.dmp

Filesize
8KB

Download
memory/928-72-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1692-78-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/1788-68-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1988-59-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/1988-64-0x0000000004950000-0x00000000049C4000-memory.dmp

Filesize
464KB

Download
memory/1988-63-0x0000000008020000-0x00000000080D8000-memory.dmp

Filesize
736KB

Download
memory/1988-62-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/1988-61-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing