Analysis
-
max time kernel
117s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:21
General
-
Target
Migliore consulenza globale sui pagamenti PI # CFL002 19A.exe
-
Size
1.3MB
-
MD5
9c2453b22e9e215094d90a25303ae8d2
-
SHA1
01ac8fb2a2810aa5eef6b113a6b8c70a7acb8ffc
-
SHA256
1872a9eaa84a2a54125c3d8e5196f998808f808942c69192340e731a58ff971f
-
SHA512
90038e73f6260dbd7a0ac839b33468cc55e7f3542059625975a97a2e8efcdf24925d0dacac81245962d12a506b96336f835164c81eec8b55f41d83bdc30d0fe8
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Migliore consulenza globale sui pagamenti PI # CFL002 19A.exe"C:\Users\Admin\AppData\Local\Temp\Migliore consulenza globale sui pagamenti PI # CFL002 19A.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeHbKjHwF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6F35.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Migliore consulenza globale sui pagamenti PI # CFL002 19A.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Migliore consulenza globale sui pagamenti PI # CFL002 19A.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Migliore consulenza globale sui pagamenti PI # CFL002 19A.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
1KB
MD50d18058104df6b61d502c0584d1b0f63
SHA1227133cf05a96d845aaa74f07027ebd067b4af9f
SHA256fbd519b022a5b9688be0aaa620cb37cef7449970ee9ebcb8fa78f62501ecb72e
SHA512cc986a2f0afc7300d6d975fe634cea36db07c2acd47f04605f156ced3943e1b316d01a2c7d4d25e8198ad6784a2807cf12bbca133dd747095f3572a2bf33b12e
-
-
-
Filesize
736KB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
1.3MB
-
-
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
120KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
600KB
-
Filesize
136KB