a310logger | 8742189aa8e9303ed7ce67da39348d2bb6628a6c5243c6e9a968499098f42178

General

Target

SO#5933772-00,xlsx.exe
Size

1.0MB
MD5

3dbc477725b5a88f511f1b4e3bcc38fc
SHA1

a81ed8a5aed97fb6efa956e5c485f2aad8467e9f
SHA256

8742189aa8e9303ed7ce67da39348d2bb6628a6c5243c6e9a968499098f42178
SHA512

60de5350d98658ab152bd361e5a7fe6c5c3f294ced8067a8ea1a3e98004759723457a9e9e36a6cc01c5a35474ab4db06695111a0143972ffb0fdfe55c97da517

Score

10^/10

a310logger spyware stealer

Malware Config

Signatures

A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware a310logger

A310logger Executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe	a310logger
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe	a310logger

Executes dropped EXE 1 IoCs

Processes:

Fox.exe

pid process

220 Fox.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

SO#5933772-00,xlsx.exe

description pid process target process

PID 1728 set thread context of 1200 1728 SO#5933772-00,xlsx.exe SO#5933772-00,xlsx.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4012 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SO#5933772-00,xlsx.exe

pid process

1728 SO#5933772-00,xlsx.exe
1728 SO#5933772-00,xlsx.exe
1728 SO#5933772-00,xlsx.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SO#5933772-00,xlsx.exe

description pid process

Token: SeDebugPrivilege 1728 SO#5933772-00,xlsx.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SO#5933772-00,xlsx.exe

pid process

1200 SO#5933772-00,xlsx.exe

pid	process
220	Fox.exe

description	pid	process	target process
PID 1728 set thread context of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe

pid	process
4012	schtasks.exe

pid	process
1728	SO#5933772-00,xlsx.exe
1728	SO#5933772-00,xlsx.exe
1728	SO#5933772-00,xlsx.exe

description	pid	process
Token: SeDebugPrivilege	1728	SO#5933772-00,xlsx.exe

pid	process
1200	SO#5933772-00,xlsx.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

SO#5933772-00,xlsx.exeSO#5933772-00,xlsx.exeWinMail.exe

description	pid	process	target process
PID 1728 wrote to memory of 4012	1728	SO#5933772-00,xlsx.exe	schtasks.exe
PID 1728 wrote to memory of 4012	1728	SO#5933772-00,xlsx.exe	schtasks.exe
PID 1728 wrote to memory of 4012	1728	SO#5933772-00,xlsx.exe	schtasks.exe
PID 1728 wrote to memory of 1656	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1656	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1656	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1728 wrote to memory of 1200	1728	SO#5933772-00,xlsx.exe	SO#5933772-00,xlsx.exe
PID 1200 wrote to memory of 220	1200	SO#5933772-00,xlsx.exe	Fox.exe
PID 1200 wrote to memory of 220	1200	SO#5933772-00,xlsx.exe	Fox.exe
PID 1200 wrote to memory of 2376	1200	SO#5933772-00,xlsx.exe	WinMail.exe
PID 1200 wrote to memory of 2376	1200	SO#5933772-00,xlsx.exe	WinMail.exe
PID 1200 wrote to memory of 2376	1200	SO#5933772-00,xlsx.exe	WinMail.exe
PID 2376 wrote to memory of 2384	2376	WinMail.exe	WinMail.exe
PID 2376 wrote to memory of 2384	2376	WinMail.exe	WinMail.exe

C:\Users\Admin\AppData\Local\Temp\SO#5933772-00,xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\SO#5933772-00,xlsx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VqTEFYQXsiQibk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE11E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\SO#5933772-00,xlsx.exe
  "C:\Users\Admin\AppData\Local\Temp\SO#5933772-00,xlsx.exe"
  2⤵
  PID:1656
- C:\Users\Admin\AppData\Local\Temp\SO#5933772-00,xlsx.exe
  "C:\Users\Admin\AppData\Local\Temp\SO#5933772-00,xlsx.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
    3⤵
    - Executes dropped EXE
    PID:220
- - C:\Program Files (x86)\Windows Mail\WinMail.exe
    "C:\Program Files (x86)\Windows Mail\WinMail" OCInstallUserConfigOE
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Program Files\Windows Mail\WinMail.exe
      "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
      4⤵
      PID:2384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE11E.tmp

MD5
06a037015e4d12e191fd7464e5f00344

SHA1
c41e6e833ee60143c0fdd67c2b50c00cfa1c43c4

SHA256
11ec43313397ebdf122ced249d648951c13e5d70f7f177b09b7f63a156a3f417

SHA512
6228b71849f1f6d2b4d3ce25e1c96868e7be1ce323475f16c1f5e225b23863f09dc83afebb155969d164c6a8fdcc9fdf09b14582ac7b31dea486a70c4d15a11b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe

MD5
91b41651e6e9ab352805c6d35a297d08

SHA1
11b8eaa7b7941461bc952b11ec3f07d25dcd1c2e

SHA256
0872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723

SHA512
b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe

MD5
91b41651e6e9ab352805c6d35a297d08

SHA1
11b8eaa7b7941461bc952b11ec3f07d25dcd1c2e

SHA256
0872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723

SHA512
b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\credentials.txt

MD5
055c857272026583a61e1b5821c69a24

SHA1
ec39d34f16487682801dd2b319554cbed57feca4

SHA256
190db16bb64995e3bdea04b9e6fc1994dacfea3253a7559732205b1d41362b84

SHA512
d7833c4651683e95959107e05b07b60d2e963b9fbecd0106b329e2087d1dfc9aedb962b334e22b6b462699cbce86097d4d50ce5d1310ad098e3531efaa4e204b

Download Submit
memory/220-136-0x000000001BBF0000-0x000000001BBF2000-memory.dmp

Filesize
8KB

Download
memory/220-134-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/220-131-0x0000000000000000-mapping.dmp

Download
memory/1200-128-0x0000000000401B9C-mapping.dmp

Download
memory/1200-127-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1728-120-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/1728-124-0x000000000A490000-0x000000000A4F1000-memory.dmp

Filesize
388KB

Download
memory/1728-123-0x0000000007D70000-0x0000000007E3E000-memory.dmp

Filesize
824KB

Download
memory/1728-122-0x0000000005760000-0x0000000005C5E000-memory.dmp

Filesize
5.0MB

Download
memory/1728-121-0x0000000005AD0000-0x0000000005AE1000-memory.dmp

Filesize
68KB

Download
memory/1728-114-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/1728-119-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/1728-118-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/1728-117-0x0000000005C60000-0x0000000005C61000-memory.dmp

Filesize
4KB

Download
memory/1728-116-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/2376-138-0x0000000000000000-mapping.dmp

Download
memory/2384-139-0x0000000000000000-mapping.dmp

Download
memory/4012-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads