Analysis
-
max time kernel
128s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
28-03-2022 20:50
Static task
static1
Behavioral task
behavioral1
Sample
5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe
Resource
win10v2004-en-20220113
General
-
Target
5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe
-
Size
1.0MB
-
MD5
8120df9b2ed51328ce8df5a6ab4d498a
-
SHA1
1b312069c24d2ceb384b8bed9c4a58fb932c89b2
-
SHA256
5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc
-
SHA512
44bcd103fed8c7e0b55a0c82563a974845b828c2ec23f629298b466c012dcd05b6c03cab0adf884eadb4241997b805a490836daff86097230d755c32bcbabd61
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
resource yara_rule behavioral2/memory/1152-134-0x0000000000A80000-0x0000000000B06000-memory.dmp family_masslogger behavioral2/memory/1152-135-0x0000000000A80000-0x0000000000B06000-memory.dmp family_masslogger -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBBBBBBBB.vbs notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3668 set thread context of 1152 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 82 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 1152 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 1152 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 2848 powershell.exe 2848 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1152 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Token: SeDebugPrivilege 2848 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3668 wrote to memory of 1804 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 81 PID 3668 wrote to memory of 1804 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 81 PID 3668 wrote to memory of 1804 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 81 PID 3668 wrote to memory of 1804 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 81 PID 3668 wrote to memory of 1804 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 81 PID 3668 wrote to memory of 1152 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 82 PID 3668 wrote to memory of 1152 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 82 PID 3668 wrote to memory of 1152 3668 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 82 PID 1152 wrote to memory of 2848 1152 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 84 PID 1152 wrote to memory of 2848 1152 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 84 PID 1152 wrote to memory of 2848 1152 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe"C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:1804
-
-
C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe"C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-