Overview

overview

10

Static

static

1283YT3481...JI.exe

windows7_x64

10

1283YT3481...JI.exe

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09-08-2021 12:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1283YT348130Et-21 -10000,00-EUR-SWIFT MESAJI.exe

  • Size

    922KB

  • MD5

    a6c09767f7b9b02156bd3e4f67764e79

  • SHA1

    5aa1d0515cd9ca1802c872cd8a9354b65cef7463

  • SHA256

    2183dd8a07c328ff41cf8fedc06bdc9ec8166d6c11691cb6d379899318d8e555

  • SHA512

    5f7072604303b4bea39a1c4751e09eb8399d9a10984ba2ddb699680145c952fb71d180e3e56135d30aa9639e9f5ff3899a3e58a2b7ab5d0ec38b88f94f17aa50

Score
10/10
a310loggerspywarestealer

Malware Config

Signatures

  • A310logger

    A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarea310logger
  • A310logger Executable 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1283YT348130Et-21 -10000,00-EUR-SWIFT MESAJI.exe
    "C:\Users\Admin\AppData\Local\Temp\1283YT348130Et-21 -10000,00-EUR-SWIFT MESAJI.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LEjGKtEzH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2442.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1056
    • C:\Users\Admin\AppData\Local\Temp\1283YT348130Et-21 -10000,00-EUR-SWIFT MESAJI.exe
      "C:\Users\Admin\AppData\Local\Temp\1283YT348130Et-21 -10000,00-EUR-SWIFT MESAJI.exe"
      2⤵
        PID:1904
      • C:\Users\Admin\AppData\Local\Temp\1283YT348130Et-21 -10000,00-EUR-SWIFT MESAJI.exe
        "C:\Users\Admin\AppData\Local\Temp\1283YT348130Et-21 -10000,00-EUR-SWIFT MESAJI.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3352
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
          3⤵
          • Executes dropped EXE
          PID:4056
        • C:\Program Files (x86)\Windows Mail\WinMail.exe
          "C:\Program Files (x86)\Windows Mail\WinMail" OCInstallUserConfigOE
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3732
          • C:\Program Files\Windows Mail\WinMail.exe
            "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
            4⤵
              PID:1668

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3352-127-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

        Download

      • memory/3896-124-0x000000000B4F0000-0x000000000B54D000-memory.dmp

        Filesize

        372KB

        Download

      • memory/3896-114-0x0000000000860000-0x0000000000861000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3896-119-0x0000000005150000-0x0000000005151000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3896-120-0x0000000005460000-0x0000000005461000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3896-123-0x0000000008C00000-0x0000000008CC8000-memory.dmp

        Filesize

        800KB

        Download

      • memory/3896-118-0x0000000005250000-0x0000000005251000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3896-117-0x0000000005750000-0x0000000005751000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3896-116-0x00000000051B0000-0x00000000051B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3896-122-0x0000000005600000-0x0000000005611000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3896-121-0x0000000005250000-0x000000000574E000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/4056-134-0x00000000004E0000-0x00000000004E1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4056-136-0x000000001B1B0000-0x000000001B1B2000-memory.dmp

        Filesize

        8KB

        Download