Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:06
Static task
static1
Behavioral task
behavioral1
Sample
IMAGE.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
IMAGE.exe
Resource
win10v2004-20220414-en
General
-
Target
IMAGE.exe
-
Size
1.3MB
-
MD5
77fe809f6ab75c8e4ca3b09d79e7d1c5
-
SHA1
081154438bcc637acd03bb10e18c71755692ef09
-
SHA256
2f4324dda02f8721cf5c0c0ed404de8fedbc46cf8fb1dda0e3ec3d07d6fb42e0
-
SHA512
fd36cdffe011dce3104046769f60c5104a5f5c1e4045e82e749281d22ef2461969b41b064c20547fecb47e6c1f4c57fca73b367b307a35a952e8a9e694617a52
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\781F780B4E\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 36 IoCs
Processes:
resource yara_rule behavioral2/memory/5088-133-0x00000000006B0000-0x000000000080E000-memory.dmp family_masslogger C:\Users\Admin\AppData\Roaming\Vwifibus.exe family_masslogger C:\Users\Admin\AppData\Roaming\Vwifibus.exe family_masslogger behavioral2/memory/1408-147-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-149-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-151-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-153-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-155-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-157-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-159-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-161-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-163-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-165-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-167-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-169-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-171-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-173-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-175-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-177-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-179-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-181-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-183-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-185-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-187-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-189-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-191-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-193-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-195-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-197-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-199-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-201-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-203-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-205-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-207-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-209-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger behavioral2/memory/1408-211-0x00000000005C0000-0x0000000000670000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 2 IoCs
Processes:
Vwifibus.exeAddInProcess32.exepid process 2796 Vwifibus.exe 1408 AddInProcess32.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IMAGE.exeAddInProcess32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation IMAGE.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation AddInProcess32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vwifibus = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Vwifibus.exe" reg.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Vwifibus.exedescription pid process target process PID 2796 set thread context of 1408 2796 Vwifibus.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
IMAGE.exeVwifibus.exeAddInProcess32.exepid process 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 5088 IMAGE.exe 2796 Vwifibus.exe 2796 Vwifibus.exe 2796 Vwifibus.exe 1408 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
IMAGE.exeVwifibus.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 5088 IMAGE.exe Token: SeDebugPrivilege 2796 Vwifibus.exe Token: SeDebugPrivilege 1408 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
IMAGE.execmd.exeVwifibus.exedescription pid process target process PID 5088 wrote to memory of 2612 5088 IMAGE.exe cmd.exe PID 5088 wrote to memory of 2612 5088 IMAGE.exe cmd.exe PID 5088 wrote to memory of 2612 5088 IMAGE.exe cmd.exe PID 2612 wrote to memory of 4272 2612 cmd.exe reg.exe PID 2612 wrote to memory of 4272 2612 cmd.exe reg.exe PID 2612 wrote to memory of 4272 2612 cmd.exe reg.exe PID 5088 wrote to memory of 2796 5088 IMAGE.exe Vwifibus.exe PID 5088 wrote to memory of 2796 5088 IMAGE.exe Vwifibus.exe PID 5088 wrote to memory of 2796 5088 IMAGE.exe Vwifibus.exe PID 2796 wrote to memory of 1408 2796 Vwifibus.exe AddInProcess32.exe PID 2796 wrote to memory of 1408 2796 Vwifibus.exe AddInProcess32.exe PID 2796 wrote to memory of 1408 2796 Vwifibus.exe AddInProcess32.exe PID 2796 wrote to memory of 1408 2796 Vwifibus.exe AddInProcess32.exe PID 2796 wrote to memory of 1408 2796 Vwifibus.exe AddInProcess32.exe PID 2796 wrote to memory of 1408 2796 Vwifibus.exe AddInProcess32.exe PID 2796 wrote to memory of 1408 2796 Vwifibus.exe AddInProcess32.exe PID 2796 wrote to memory of 1408 2796 Vwifibus.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMAGE.exe"C:\Users\Admin\AppData\Local\Temp\IMAGE.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Vwifibus /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Vwifibus.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Vwifibus /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Vwifibus.exe"3⤵
- Adds Run key to start application
PID:4272 -
C:\Users\Admin\AppData\Roaming\Vwifibus.exe"C:\Users\Admin\AppData\Roaming\Vwifibus.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Roaming\Vwifibus.exeFilesize
1.3MB
MD577fe809f6ab75c8e4ca3b09d79e7d1c5
SHA1081154438bcc637acd03bb10e18c71755692ef09
SHA2562f4324dda02f8721cf5c0c0ed404de8fedbc46cf8fb1dda0e3ec3d07d6fb42e0
SHA512fd36cdffe011dce3104046769f60c5104a5f5c1e4045e82e749281d22ef2461969b41b064c20547fecb47e6c1f4c57fca73b367b307a35a952e8a9e694617a52
-
C:\Users\Admin\AppData\Roaming\Vwifibus.exeFilesize
1.3MB
MD577fe809f6ab75c8e4ca3b09d79e7d1c5
SHA1081154438bcc637acd03bb10e18c71755692ef09
SHA2562f4324dda02f8721cf5c0c0ed404de8fedbc46cf8fb1dda0e3ec3d07d6fb42e0
SHA512fd36cdffe011dce3104046769f60c5104a5f5c1e4045e82e749281d22ef2461969b41b064c20547fecb47e6c1f4c57fca73b367b307a35a952e8a9e694617a52
-
memory/1408-169-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-657-0x0000000004DF0000-0x0000000004E56000-memory.dmpFilesize
408KB
-
memory/1408-658-0x00000000063B0000-0x00000000063BA000-memory.dmpFilesize
40KB
-
memory/1408-173-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-175-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-656-0x0000000004B70000-0x0000000004C0C000-memory.dmpFilesize
624KB
-
memory/1408-143-0x0000000000000000-mapping.dmp
-
memory/1408-211-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-209-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-147-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-149-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-151-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-153-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-155-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-157-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-159-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-161-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-177-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-165-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-167-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-207-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-171-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-205-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-203-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-163-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-179-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-181-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-183-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-185-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-187-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-189-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-191-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-193-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-195-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-197-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-199-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/1408-201-0x00000000005C0000-0x0000000000670000-memory.dmpFilesize
704KB
-
memory/2612-137-0x0000000000000000-mapping.dmp
-
memory/2796-142-0x00000000069A0000-0x00000000069C2000-memory.dmpFilesize
136KB
-
memory/2796-139-0x0000000000000000-mapping.dmp
-
memory/4272-138-0x0000000000000000-mapping.dmp
-
memory/5088-133-0x00000000006B0000-0x000000000080E000-memory.dmpFilesize
1.4MB
-
memory/5088-134-0x0000000005780000-0x0000000005D24000-memory.dmpFilesize
5.6MB
-
memory/5088-135-0x00000000052D0000-0x0000000005362000-memory.dmpFilesize
584KB
-
memory/5088-136-0x00000000056D0000-0x0000000005714000-memory.dmpFilesize
272KB