Analysis
- max time kernel
128s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/05/2022, 00:53
General
- Target Inquiry List Details.exe
- Size 868KB
- Sample220521-a8mchabea5
- SHA256 fb248d3c4b08dd0bef37e565fbe078a57f13b5214b8cafeccf42bdd50767678d
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inquiry List Details.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry List Details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry List Details.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry List Details.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Inquiry List Details.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Inquiry List Details.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1788-142-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/1788-143-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/1788-147-0x00000000066B0000-0x00000000066D2000-memory.dmp
memory/1788-146-0x0000000007150000-0x00000000071E6000-memory.dmp
memory/1788-145-0x00000000065E0000-0x00000000065FA000-memory.dmp
memory/1788-144-0x0000000007730000-0x0000000007DAA000-memory.dmp
memory/1788-141-0x0000000005210000-0x0000000005232000-memory.dmp
memory/1788-139-0x00000000027E0000-0x0000000002816000-memory.dmp
memory/1788-140-0x0000000005350000-0x0000000005978000-memory.dmp
memory/4984-131-0x0000000005A90000-0x0000000006034000-memory.dmp
memory/4984-130-0x00000000009C0000-0x0000000000AA0000-memory.dmp
memory/4984-133-0x0000000005960000-0x00000000059FC000-memory.dmp
memory/4984-132-0x0000000005420000-0x00000000054B2000-memory.dmp
memory/5108-136-0x0000000005600000-0x0000000005666000-memory.dmp
memory/5108-135-0x0000000000400000-0x00000000004B8000-memory.dmp