masslogger | 9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60

General

Target

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Size

1.1MB
MD5

ab41c3e043242673290648de262f675e
SHA1

79b01822385f4333f0fd8fe800b4b6dcf703de8c
SHA256

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60
SHA512

37bb4ab731730e106e1a44d9c1db962f02eecf4f642a91888632a4b26d3ec56a88a3fddb68f234887da433dd9d844fc9271a16eed23efe6d1afde143072212e9

Score

10^/10

masslogger collection spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.paminakids.com
Port:
587
Username:
[email protected]
Password:
nRBy874S437

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/864-63-0x0000000000520000-0x00000000005A6000-memory.dmp	family_masslogger
behavioral1/memory/864-64-0x0000000000520000-0x00000000005A6000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

1544 powershell.exe
Drops startup file 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sososo.vbs notepad.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1544	powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sososo.vbs	notepad.exe

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	pid	process	target process
PID 1376 set thread context of 864	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

pid process

864 9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

pid	process
864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exepowershell.exepowershell.exe

pid	process
1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
1056	powershell.exe
1544	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

pid process

1376 9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

pid process

864 9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

pid	process
864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	pid	process	target process
PID 1376 wrote to memory of 1408	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 1376 wrote to memory of 1408	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 1376 wrote to memory of 1408	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 1376 wrote to memory of 1408	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 1376 wrote to memory of 1408	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 1376 wrote to memory of 1408	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 1376 wrote to memory of 864	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
PID 1376 wrote to memory of 864	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
PID 1376 wrote to memory of 864	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
PID 1376 wrote to memory of 864	1376	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
PID 864 wrote to memory of 1056	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 864 wrote to memory of 1056	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 864 wrote to memory of 1056	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 864 wrote to memory of 1056	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 864 wrote to memory of 1544	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 864 wrote to memory of 1544	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 864 wrote to memory of 1544	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 864 wrote to memory of 1544	864	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe

outlook_office_path 1 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

outlook_win_path 1 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
"C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:1408
- C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
  "C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe"
  2⤵
  - Checks computer location settings
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe'
    3⤵
    - Deletes itself
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
54feb4f589701102bcdfb70c0be02e70

SHA1
fe8b593c7cc931ea497fd0868a70c17eeba17525

SHA256
d429bc8b7592c1de2504b6ef0f02ef3f21589ebd7a66151fa2a9c5fcfbbe0ba2

SHA512
8ddd7dd179463f5fc7d4246ab723bf8e6bf67caec244b11427036005c061c6cf2d5dda4d4ca6c02bfac57e809b606bd182716dd2135dec68a70a09111c148192

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/864-66-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-75-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-63-0x0000000000520000-0x00000000005A6000-memory.dmp

Filesize
536KB

Download
memory/864-64-0x0000000000520000-0x00000000005A6000-memory.dmp

Filesize
536KB

Download
memory/864-79-0x0000000006070000-0x0000000006100000-memory.dmp

Filesize
576KB

Download
memory/864-67-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-68-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-69-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-70-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-71-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-72-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-73-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-74-0x0000000002072000-0x0000000002073000-memory.dmp

Filesize
4KB

Download
memory/864-62-0x000000000051C750-mapping.dmp

Download
memory/864-78-0x0000000006000000-0x000000000603E000-memory.dmp

Filesize
248KB

Download
memory/864-77-0x00000000021B5000-0x00000000021C6000-memory.dmp

Filesize
68KB

Download
memory/1056-76-0x0000000000000000-mapping.dmp

Download
memory/1056-82-0x000000006EFF0000-0x000000006F59B000-memory.dmp

Filesize
5.7MB

Download
memory/1056-83-0x0000000002322000-0x0000000002324000-memory.dmp

Filesize
8KB

Download
memory/1376-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1376-56-0x0000000002020000-0x0000000002032000-memory.dmp

Filesize
72KB

Download
memory/1408-57-0x0000000000000000-mapping.dmp

Download
memory/1408-58-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1544-84-0x0000000000000000-mapping.dmp

Download
memory/1544-88-0x0000000074160000-0x000000007470B000-memory.dmp

Filesize
5.7MB

Download
memory/1544-89-0x00000000021A2000-0x00000000021A4000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads