Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 02:42
Static task
static1
Behavioral task
behavioral1
Sample
[C38226] #TD JMMasuda_Mfg.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
[C38226] #TD JMMasuda_Mfg.exe
Resource
win10v2004-20220414-en
General
-
Target
[C38226] #TD JMMasuda_Mfg.exe
-
Size
817KB
-
MD5
6ca7ca71e6777e838bb32c911e5e68eb
-
SHA1
a3c11cc089fd8f5db0d673d9f4f63d495ee3cffe
-
SHA256
fbc70395ea55477b8827145c12f85133565b1be20e31f71327ea17d2706127be
-
SHA512
c772675fe56dc2d95bdf7ff59c0a0ea81f0743f074cb5c7e9c29fc78e8f9eb19eb023d9b0a2bf2f9aadef2250dba78667a454db46275c7a9a91a800180ccef58
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt
masslogger
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/2016-56-0x00000000004F0000-0x00000000004F8000-memory.dmp coreentity -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 32 IoCs
Processes:
resource yara_rule behavioral1/memory/2000-63-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-64-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-65-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-66-0x00000000004A1CBE-mapping.dmp family_masslogger behavioral1/memory/2000-68-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-70-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-72-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-74-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-76-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-78-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-80-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-82-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-84-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-86-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-88-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-90-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-92-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-94-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-96-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-98-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-100-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-102-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-104-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-106-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-108-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-110-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-112-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-114-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-116-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-118-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-120-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/2000-122-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/2016-57-0x0000000005D60000-0x0000000005E0E000-memory.dmp rezer0 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
[C38226] #TD JMMasuda_Mfg.exedescription pid process target process PID 2016 set thread context of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1700 2000 WerFault.exe RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
[C38226] #TD JMMasuda_Mfg.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2016 [C38226] #TD JMMasuda_Mfg.exe Token: SeDebugPrivilege 2000 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
[C38226] #TD JMMasuda_Mfg.exeRegSvcs.exedescription pid process target process PID 2016 wrote to memory of 1752 2016 [C38226] #TD JMMasuda_Mfg.exe schtasks.exe PID 2016 wrote to memory of 1752 2016 [C38226] #TD JMMasuda_Mfg.exe schtasks.exe PID 2016 wrote to memory of 1752 2016 [C38226] #TD JMMasuda_Mfg.exe schtasks.exe PID 2016 wrote to memory of 1752 2016 [C38226] #TD JMMasuda_Mfg.exe schtasks.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2016 wrote to memory of 2000 2016 [C38226] #TD JMMasuda_Mfg.exe RegSvcs.exe PID 2000 wrote to memory of 1700 2000 RegSvcs.exe WerFault.exe PID 2000 wrote to memory of 1700 2000 RegSvcs.exe WerFault.exe PID 2000 wrote to memory of 1700 2000 RegSvcs.exe WerFault.exe PID 2000 wrote to memory of 1700 2000 RegSvcs.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\[C38226] #TD JMMasuda_Mfg.exe"C:\Users\Admin\AppData\Local\Temp\[C38226] #TD JMMasuda_Mfg.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CIbVwu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5439.tmp"2⤵
- Creates scheduled task(s)
PID:1752 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 13003⤵
- Program crash
PID:1700
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5439.tmpFilesize
1KB
MD5fe02e3e13abc46e2e96f0f4adf80b8cf
SHA1c34c3f26589423074e6708d80619f2d15ef06e71
SHA256142b2d4e3addec12f5652d1d4d753bc3e4a851f3064a3b615691ea943ba898ac
SHA512bbd44be01e5e9cc0cab0d343747ed5c9666aaff9d6027719c3110cc26398c54d758e50c3a2eecbf475c631dbafaf626b4f76aa42f85a60ffbdbe591203a01e28
-
memory/1700-572-0x0000000000000000-mapping.dmp
-
memory/1752-58-0x0000000000000000-mapping.dmp
-
memory/2000-84-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-122-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-88-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-60-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-61-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-63-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-64-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-65-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-86-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-68-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-70-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-72-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-74-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-76-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-78-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-80-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-82-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-120-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-66-0x00000000004A1CBE-mapping.dmp
-
memory/2000-118-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-100-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-92-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-94-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-96-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-98-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-90-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-102-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-104-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-106-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-108-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-110-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-112-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-114-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2000-116-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2016-57-0x0000000005D60000-0x0000000005E0E000-memory.dmpFilesize
696KB
-
memory/2016-54-0x0000000000890000-0x0000000000962000-memory.dmpFilesize
840KB
-
memory/2016-56-0x00000000004F0000-0x00000000004F8000-memory.dmpFilesize
32KB
-
memory/2016-55-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB