Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-05-2022 11:52
Static task
static1
Behavioral task
behavioral1
Sample
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe
Resource
win10v2004-20220414-en
General
-
Target
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe
-
Size
63KB
-
MD5
9568c589eb240860758e5b783bc1d379
-
SHA1
694a7b0fac2c471da6306568efbce1e67199c91d
-
SHA256
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3
-
SHA512
c3cd9401acebbd61804325678fff0af7f0522d6d5e5c30bc8eb2795644e7d5970b161174cd0e94dfd4a400a795cf1429d998fcdae6ca32ad2532d8ef60213c66
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3552-135-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exepid process 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exedescription pid process target process PID 3388 set thread context of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5084 3388 WerFault.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2648 timeout.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exepowershell.exepid process 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3552 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 3552 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 2740 powershell.exe 2740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exepowershell.exedescription pid process Token: SeDebugPrivilege 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe Token: SeDebugPrivilege 3552 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe Token: SeDebugPrivilege 2740 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exedescription pid process target process PID 3388 wrote to memory of 2648 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe timeout.exe PID 3388 wrote to memory of 2648 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe timeout.exe PID 3388 wrote to memory of 2648 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe timeout.exe PID 3388 wrote to memory of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe PID 3388 wrote to memory of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe PID 3388 wrote to memory of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe PID 3388 wrote to memory of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe PID 3388 wrote to memory of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe PID 3388 wrote to memory of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe PID 3388 wrote to memory of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe PID 3388 wrote to memory of 3552 3388 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe PID 3552 wrote to memory of 2740 3552 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe powershell.exe PID 3552 wrote to memory of 2740 3552 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe powershell.exe PID 3552 wrote to memory of 2740 3552 9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe"C:\Users\Admin\AppData\Local\Temp\9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 42⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe"C:\Users\Admin\AppData\Local\Temp\9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 17882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3388 -ip 33881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2648-132-0x0000000000000000-mapping.dmp
-
memory/2740-142-0x0000000005570000-0x00000000055D6000-memory.dmpFilesize
408KB
-
memory/2740-144-0x00000000074A0000-0x0000000007B1A000-memory.dmpFilesize
6.5MB
-
memory/2740-139-0x00000000046E0000-0x0000000004716000-memory.dmpFilesize
216KB
-
memory/2740-147-0x0000000006230000-0x0000000006252000-memory.dmpFilesize
136KB
-
memory/2740-140-0x0000000004D50000-0x0000000005378000-memory.dmpFilesize
6.2MB
-
memory/2740-146-0x0000000006EC0000-0x0000000006F56000-memory.dmpFilesize
600KB
-
memory/2740-141-0x00000000054D0000-0x00000000054F2000-memory.dmpFilesize
136KB
-
memory/2740-145-0x0000000006170000-0x000000000618A000-memory.dmpFilesize
104KB
-
memory/2740-138-0x0000000000000000-mapping.dmp
-
memory/2740-143-0x0000000005C60000-0x0000000005C7E000-memory.dmpFilesize
120KB
-
memory/3388-131-0x0000000005850000-0x00000000058EC000-memory.dmpFilesize
624KB
-
memory/3388-133-0x0000000006B90000-0x0000000007134000-memory.dmpFilesize
5.6MB
-
memory/3388-130-0x0000000000FF0000-0x0000000001004000-memory.dmpFilesize
80KB
-
memory/3552-136-0x00000000057E0000-0x0000000005872000-memory.dmpFilesize
584KB
-
memory/3552-134-0x0000000000000000-mapping.dmp
-
memory/3552-137-0x0000000005880000-0x00000000058E6000-memory.dmpFilesize
408KB
-
memory/3552-135-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB