Analysis
-
max time kernel
93s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:53
Static task
static1
Behavioral task
behavioral1
Sample
LP40728194004.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
LP40728194004.exe
Resource
win10v2004-20220414-en
General
-
Target
LP40728194004.exe
-
Size
1.3MB
-
MD5
81297e7d0a24d0566bf47c8bebd0a3e2
-
SHA1
c2dc509acef33461268ba76bafbdb11e81e3d759
-
SHA256
3d0af7312beff6b913ae04b6c6b3f9aac323308a1933952d1c8bd732fdf290ce
-
SHA512
ac8bc8716d999c6bedc13f1c479e44e43288946beb46403a415004f43a1cbdbf63c5047ce6e5cf89065730fc750e1176b5bda8d006ece6e6d9a456df47aec986
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3912-133-0x0000000000C00000-0x0000000000CB8000-memory.dmp family_masslogger behavioral2/memory/3912-132-0x0000000000C00000-0x0000000000CB8000-memory.dmp family_masslogger -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LP40728194004.exedescription pid process target process PID 1684 set thread context of 3912 1684 LP40728194004.exe LP40728194004.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
LP40728194004.exeLP40728194004.exepowershell.exepid process 1684 LP40728194004.exe 1684 LP40728194004.exe 3912 LP40728194004.exe 3912 LP40728194004.exe 3404 powershell.exe 3404 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
LP40728194004.exepid process 1684 LP40728194004.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
LP40728194004.exepowershell.exedescription pid process Token: SeDebugPrivilege 3912 LP40728194004.exe Token: SeDebugPrivilege 3404 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
LP40728194004.exeLP40728194004.execmd.exedescription pid process target process PID 1684 wrote to memory of 3912 1684 LP40728194004.exe LP40728194004.exe PID 1684 wrote to memory of 3912 1684 LP40728194004.exe LP40728194004.exe PID 1684 wrote to memory of 3912 1684 LP40728194004.exe LP40728194004.exe PID 3912 wrote to memory of 2556 3912 LP40728194004.exe cmd.exe PID 3912 wrote to memory of 2556 3912 LP40728194004.exe cmd.exe PID 3912 wrote to memory of 2556 3912 LP40728194004.exe cmd.exe PID 2556 wrote to memory of 3404 2556 cmd.exe powershell.exe PID 2556 wrote to memory of 3404 2556 cmd.exe powershell.exe PID 2556 wrote to memory of 3404 2556 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LP40728194004.exe"C:\Users\Admin\AppData\Local\Temp\LP40728194004.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LP40728194004.exe"C:\Users\Admin\AppData\Local\Temp\LP40728194004.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\LP40728194004.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\LP40728194004.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-131-0x0000000000400000-0x0000000000548000-memory.dmpFilesize
1.3MB
-
memory/2556-138-0x0000000000000000-mapping.dmp
-
memory/3404-142-0x0000000004B90000-0x0000000004BB2000-memory.dmpFilesize
136KB
-
memory/3404-145-0x0000000007390000-0x0000000007A0A000-memory.dmpFilesize
6.5MB
-
memory/3404-148-0x0000000006100000-0x0000000006122000-memory.dmpFilesize
136KB
-
memory/3404-147-0x0000000006DB0000-0x0000000006E46000-memory.dmpFilesize
600KB
-
memory/3404-146-0x0000000006020000-0x000000000603A000-memory.dmpFilesize
104KB
-
memory/3404-144-0x0000000005B20000-0x0000000005B3E000-memory.dmpFilesize
120KB
-
memory/3404-143-0x00000000053C0000-0x0000000005426000-memory.dmpFilesize
408KB
-
memory/3404-139-0x0000000000000000-mapping.dmp
-
memory/3404-140-0x00000000045A0000-0x00000000045D6000-memory.dmpFilesize
216KB
-
memory/3404-141-0x0000000004D90000-0x00000000053B8000-memory.dmpFilesize
6.2MB
-
memory/3912-130-0x0000000000000000-mapping.dmp
-
memory/3912-133-0x0000000000C00000-0x0000000000CB8000-memory.dmpFilesize
736KB
-
memory/3912-137-0x00000000055F0000-0x0000000005682000-memory.dmpFilesize
584KB
-
memory/3912-132-0x0000000000C00000-0x0000000000CB8000-memory.dmpFilesize
736KB
-
memory/3912-136-0x0000000005320000-0x0000000005386000-memory.dmpFilesize
408KB
-
memory/3912-135-0x00000000051C0000-0x000000000525C000-memory.dmpFilesize
624KB
-
memory/3912-134-0x0000000004C00000-0x00000000051A4000-memory.dmpFilesize
5.6MB