Analysis
-
max time kernel
91s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
inquiry Nasser Al Falahy.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
inquiry Nasser Al Falahy.exe
Resource
win10v2004-20220414-en
General
-
Target
inquiry Nasser Al Falahy.exe
-
Size
1.0MB
-
MD5
a553824d8e07c030ee3d8c8c7ffbde82
-
SHA1
105230ce033771a93e3be121bcbb2b1511ceb008
-
SHA256
5a08d0f514ac2efd07cc045c1b896cf7c6426dd0013ad523a14bbdbce2b25edd
-
SHA512
854c2af6efe2ff5bfb00b7d10dd3d2a0a682ba746180a4d38d4fc9761ffe508867a7827103379c9b32b8cc8b9ceb79cbac80e1bad3e70cecbd0aa335f93bbeab
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 32 IoCs
Processes:
resource yara_rule behavioral2/memory/228-139-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-142-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-144-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-146-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-148-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-150-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-152-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-154-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-156-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-158-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-160-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-162-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-164-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-166-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-168-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-170-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-172-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-174-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-176-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-178-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-180-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-182-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-184-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-186-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-188-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-190-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-192-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-194-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-196-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-198-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-200-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/228-202-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
inquiry Nasser Al Falahy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation inquiry Nasser Al Falahy.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
inquiry Nasser Al Falahy.exedescription pid process target process PID 3848 set thread context of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4308 powershell.exe 4308 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
inquiry Nasser Al Falahy.exepowershell.exedescription pid process Token: SeDebugPrivilege 228 inquiry Nasser Al Falahy.exe Token: SeDebugPrivilege 4308 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
inquiry Nasser Al Falahy.exeinquiry Nasser Al Falahy.execmd.exedescription pid process target process PID 3848 wrote to memory of 4456 3848 inquiry Nasser Al Falahy.exe schtasks.exe PID 3848 wrote to memory of 4456 3848 inquiry Nasser Al Falahy.exe schtasks.exe PID 3848 wrote to memory of 4456 3848 inquiry Nasser Al Falahy.exe schtasks.exe PID 3848 wrote to memory of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe PID 3848 wrote to memory of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe PID 3848 wrote to memory of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe PID 3848 wrote to memory of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe PID 3848 wrote to memory of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe PID 3848 wrote to memory of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe PID 3848 wrote to memory of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe PID 3848 wrote to memory of 228 3848 inquiry Nasser Al Falahy.exe inquiry Nasser Al Falahy.exe PID 228 wrote to memory of 2316 228 inquiry Nasser Al Falahy.exe cmd.exe PID 228 wrote to memory of 2316 228 inquiry Nasser Al Falahy.exe cmd.exe PID 228 wrote to memory of 2316 228 inquiry Nasser Al Falahy.exe cmd.exe PID 2316 wrote to memory of 4308 2316 cmd.exe powershell.exe PID 2316 wrote to memory of 4308 2316 cmd.exe powershell.exe PID 2316 wrote to memory of 4308 2316 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe"C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NRQOUAsHhOY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA1B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe"C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\inquiry Nasser Al Falahy.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\inquiry Nasser Al Falahy.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
C:\Users\Admin\AppData\Local\Temp\tmpAA1B.tmpFilesize
1KB
MD53b2f69b0a00fcecfafe6fe6e8c2f4069
SHA11f729c0ada06697ce643ae03fb3597854975bbc1
SHA25602dc1223f487921e3189c511b3fd6edf5a19cf8b2328ac7208824e558ecbc32b
SHA512ee70d854634048b0ee853ba610730cd0dcace4f02a651ea565df1c20adeb2e15a4da2a26519f14e6fcf088ce58215be7eacba3deec32c2d0683b284dd08b72b8
-
memory/228-182-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-168-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-142-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-186-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-184-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-144-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-146-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-148-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-150-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-152-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-154-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-156-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-158-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-160-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-162-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-164-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-166-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-657-0x0000000005470000-0x00000000054D6000-memory.dmpFilesize
408KB
-
memory/228-170-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-172-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-174-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-176-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-178-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-180-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-138-0x0000000000000000-mapping.dmp
-
memory/228-202-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-139-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-188-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-190-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-192-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-194-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-196-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-198-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/228-200-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-658-0x0000000000000000-mapping.dmp
-
memory/3848-130-0x0000000000280000-0x0000000000388000-memory.dmpFilesize
1.0MB
-
memory/3848-131-0x0000000004D10000-0x0000000004DAC000-memory.dmpFilesize
624KB
-
memory/3848-132-0x00000000053B0000-0x0000000005954000-memory.dmpFilesize
5.6MB
-
memory/3848-133-0x0000000004EA0000-0x0000000004F32000-memory.dmpFilesize
584KB
-
memory/3848-134-0x0000000004DD0000-0x0000000004DDA000-memory.dmpFilesize
40KB
-
memory/3848-135-0x0000000005030000-0x0000000005086000-memory.dmpFilesize
344KB
-
memory/4308-659-0x0000000000000000-mapping.dmp
-
memory/4308-660-0x00000000051E0000-0x0000000005216000-memory.dmpFilesize
216KB
-
memory/4308-661-0x0000000005850000-0x0000000005E78000-memory.dmpFilesize
6.2MB
-
memory/4308-662-0x0000000005EE0000-0x0000000005F02000-memory.dmpFilesize
136KB
-
memory/4308-663-0x0000000006000000-0x0000000006066000-memory.dmpFilesize
408KB
-
memory/4308-664-0x0000000006780000-0x000000000679E000-memory.dmpFilesize
120KB
-
memory/4308-665-0x0000000007FA0000-0x000000000861A000-memory.dmpFilesize
6.5MB
-
memory/4308-666-0x0000000006C70000-0x0000000006C8A000-memory.dmpFilesize
104KB
-
memory/4308-667-0x00000000079C0000-0x0000000007A56000-memory.dmpFilesize
600KB
-
memory/4308-668-0x0000000006D30000-0x0000000006D52000-memory.dmpFilesize
136KB
-
memory/4456-136-0x0000000000000000-mapping.dmp