a310logger | fdb6b5f3b83553b83111bd61152a4c4bd29996d778d6c118f52f01abd9435fe5

General

Target

RFQ k Peikko proposal,pdf.exe
Size

1.0MB
MD5

b44f95c332073b28fe95157f470f8f2a
SHA1

ab9265412559d4992d540aa11f05d73e4f544374
SHA256

fdb6b5f3b83553b83111bd61152a4c4bd29996d778d6c118f52f01abd9435fe5
SHA512

25bd35d5bd9d233d9f0bc21afa1af51c2326a252d3afe16f65a22f17ec85bd7a73529b24f4408d20aa0aec84dc79339574f4e57f1876f480bbb6b23cc5aa8f4d

Score

10^/10

a310logger spyware stealer

Malware Config

Signatures

A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware a310logger

A310logger Executable 3 IoCs

resource	yara_rule
behavioral1/files/0x00030000000130f8-72.dat	a310logger
behavioral1/files/0x00030000000130f8-74.dat	a310logger
behavioral1/files/0x00030000000130f8-75.dat	a310logger

Executes dropped EXE 1 IoCs

pid	Process
732	Fox.exe

Loads dropped DLL 1 IoCs

pid	Process
360	RFQ k Peikko proposal,pdf.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 360	1724	RFQ k Peikko proposal,pdf.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
360	RFQ k Peikko proposal,pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
360	RFQ k Peikko proposal,pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 1724 wrote to memory of 360	1724	RFQ k Peikko proposal,pdf.exe	29
PID 360 wrote to memory of 732	360	RFQ k Peikko proposal,pdf.exe	30
PID 360 wrote to memory of 732	360	RFQ k Peikko proposal,pdf.exe	30
PID 360 wrote to memory of 732	360	RFQ k Peikko proposal,pdf.exe	30
PID 360 wrote to memory of 732	360	RFQ k Peikko proposal,pdf.exe	30

C:\Users\Admin\AppData\Local\Temp\RFQ k Peikko proposal,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ k Peikko proposal,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\RFQ k Peikko proposal,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ k Peikko proposal,pdf.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:360
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
    3⤵
    - Executes dropped EXE
    PID:732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-66-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/360-70-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/360-71-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/732-76-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/732-78-0x00000000022B0000-0x00000000022B2000-memory.dmp

Filesize
8KB

Download
memory/1724-65-0x0000000004F60000-0x0000000004FC1000-memory.dmp

Filesize
388KB

Download
memory/1724-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1724-64-0x00000000057A0000-0x000000000586A000-memory.dmp

Filesize
808KB

Download
memory/1724-63-0x00000000004F0000-0x0000000000503000-memory.dmp

Filesize
76KB

Download
memory/1724-62-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing