Analysis
-
max time kernel
100s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:47
Static task
static1
Behavioral task
behavioral1
Sample
PO 7405591, 7756947 ,7756740.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO 7405591, 7756947 ,7756740.exe
Resource
win10v2004-20220414-en
General
-
Target
PO 7405591, 7756947 ,7756740.exe
-
Size
1.2MB
-
MD5
63831c721dddee09571fe4d9df808576
-
SHA1
6fdd675db58fe108ec77ad19f72d05d908cbe07c
-
SHA256
f8a4be5923387077b32e65cfea383db1576e5dd068b926a1e9833ff24e48fd64
-
SHA512
c40638ecfab9b4de4756a29a09d68a4b896adbfedf8a43a0ebe7e09647d24a3d5e1c7bbe8fe324d090ebcf00424f59f5884cde0ac8f3974796d22a36b86da4c0
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2556-130-0x0000000000160000-0x00000000002A0000-memory.dmp family_masslogger behavioral2/memory/3696-136-0x0000000000400000-0x00000000004A8000-memory.dmp family_masslogger -
Executes dropped EXE 1 IoCs
Processes:
RegAsm.exepid process 3696 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 7405591, 7756947 ,7756740.exedescription pid process target process PID 2556 set thread context of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO 7405591, 7756947 ,7756740.exepowershell.exepid process 2556 PO 7405591, 7756947 ,7756740.exe 2556 PO 7405591, 7756947 ,7756740.exe 2556 PO 7405591, 7756947 ,7756740.exe 4704 powershell.exe 4704 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO 7405591, 7756947 ,7756740.exepowershell.exedescription pid process Token: SeDebugPrivilege 2556 PO 7405591, 7756947 ,7756740.exe Token: SeDebugPrivilege 4704 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
PO 7405591, 7756947 ,7756740.exeRegAsm.execmd.exedescription pid process target process PID 2556 wrote to memory of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe PID 2556 wrote to memory of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe PID 2556 wrote to memory of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe PID 2556 wrote to memory of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe PID 2556 wrote to memory of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe PID 2556 wrote to memory of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe PID 2556 wrote to memory of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe PID 2556 wrote to memory of 3696 2556 PO 7405591, 7756947 ,7756740.exe RegAsm.exe PID 3696 wrote to memory of 4640 3696 RegAsm.exe cmd.exe PID 3696 wrote to memory of 4640 3696 RegAsm.exe cmd.exe PID 3696 wrote to memory of 4640 3696 RegAsm.exe cmd.exe PID 4640 wrote to memory of 4704 4640 cmd.exe powershell.exe PID 4640 wrote to memory of 4704 4640 cmd.exe powershell.exe PID 4640 wrote to memory of 4704 4640 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 7405591, 7756947 ,7756740.exe"C:\Users\Admin\AppData\Local\Temp\PO 7405591, 7756947 ,7756740.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RegAsm.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RegAsm.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
memory/2556-131-0x000000000A890000-0x000000000AE34000-memory.dmpFilesize
5.6MB
-
memory/2556-132-0x000000000A380000-0x000000000A3C4000-memory.dmpFilesize
272KB
-
memory/2556-133-0x000000000A3D0000-0x000000000A3F2000-memory.dmpFilesize
136KB
-
memory/2556-134-0x000000000A5A0000-0x000000000A632000-memory.dmpFilesize
584KB
-
memory/2556-130-0x0000000000160000-0x00000000002A0000-memory.dmpFilesize
1.2MB
-
memory/3696-140-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/3696-136-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3696-139-0x00000000057C0000-0x000000000585C000-memory.dmpFilesize
624KB
-
memory/3696-135-0x0000000000000000-mapping.dmp
-
memory/4640-141-0x0000000000000000-mapping.dmp
-
memory/4704-144-0x0000000005480000-0x0000000005AA8000-memory.dmpFilesize
6.2MB
-
memory/4704-143-0x0000000002910000-0x0000000002946000-memory.dmpFilesize
216KB
-
memory/4704-142-0x0000000000000000-mapping.dmp
-
memory/4704-145-0x0000000005340000-0x00000000053A6000-memory.dmpFilesize
408KB
-
memory/4704-146-0x0000000006240000-0x000000000625E000-memory.dmpFilesize
120KB
-
memory/4704-147-0x0000000007C60000-0x00000000082DA000-memory.dmpFilesize
6.5MB
-
memory/4704-148-0x00000000066F0000-0x000000000670A000-memory.dmpFilesize
104KB
-
memory/4704-149-0x00000000072A0000-0x0000000007336000-memory.dmpFilesize
600KB
-
memory/4704-150-0x0000000007200000-0x0000000007222000-memory.dmpFilesize
136KB