Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26-03-2022 23:07

General

  • Target

    aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe

  • Size

    1.0MB

  • MD5

    02cadb9489d5db4e68b01febcf6bc2da

  • SHA1

    dbd38f77e72b4db0f7cb9d068773bbffc3a0d37e

  • SHA256

    aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126

  • SHA512

    9a7374c05ed28106096655f0beb6100372a5dd6760df6119d95dfb06180b0d78ad57a66753e52059bbd66ca2357f912e54ced01593ab97ca75ce7bdc395b37d9

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
  • Looks for VMWare Tools registry key 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe
    "C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OxshqXOJkj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3EC7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1692
    • C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe
      "C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe"
      2⤵
        PID:2064
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 968
          3⤵
          • Program crash
          PID:1936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2064 -ip 2064
      1⤵
        PID:224

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe.log

        Filesize

        1KB

        MD5

        5200da2e50f24d5d543c3f10674acdcb

        SHA1

        b574a3336839882d799c0a7f635ea238efb934ee

        SHA256

        d2d81c1c9d35bc66149beaa77029bee68664d8512fc1efe373180bab77d61026

        SHA512

        24722a7de3250a6027a411c8b79d0720554c4efd59553f54b94ab77dc21efbf3191e0912901db475f08a6e9c1855d9e9594504d80d27300097418f4384a9d9cb

      • C:\Users\Admin\AppData\Local\Temp\tmp3EC7.tmp

        Filesize

        1KB

        MD5

        90f76e769f38b843104419d176b47d7b

        SHA1

        b0f5eb1a9eec6c791cfdc4b821d166526a94e529

        SHA256

        1bf098f42898c81cd70ccc6f9ac80cb4e64dc241401a5342d6d7d9408435646e

        SHA512

        b9a2cd333811b5435c47cbfa31410904e4e0892dd349bf2020ad409a6b97736d8a9af9b58ed4c7d55c75438b1366422f58bde1301c9a2eb1a35b79d06c5c0519

      • memory/1268-130-0x0000000000DD0000-0x0000000000ED8000-memory.dmp

        Filesize

        1.0MB

      • memory/1268-131-0x0000000005750000-0x00000000057EC000-memory.dmp

        Filesize

        624KB

      • memory/1268-132-0x0000000005DA0000-0x0000000006344000-memory.dmp

        Filesize

        5.6MB

      • memory/1268-133-0x0000000005890000-0x0000000005922000-memory.dmp

        Filesize

        584KB

      • memory/1268-134-0x00000000031D0000-0x00000000031DA000-memory.dmp

        Filesize

        40KB

      • memory/1268-135-0x0000000005A20000-0x0000000005A76000-memory.dmp

        Filesize

        344KB

      • memory/1268-136-0x0000000006B20000-0x0000000006B86000-memory.dmp

        Filesize

        408KB

      • memory/2064-140-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB