Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry List Info.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Inquiry List Info.exe
Resource
win10v2004-20220414-en
General
-
Target
Inquiry List Info.exe
-
Size
1.2MB
-
MD5
a8f7c15919c3b77db76d4d6598b1d86d
-
SHA1
9e763bd6eabe57c410081551cfcbd257dcdf1fef
-
SHA256
26f2d26b01147113e1767023ecad609c6b466ce8ede36831362974f808b5f16e
-
SHA512
4a74a08452137ca45b4b87daecd89ed0223b87cb99bac39f1bdfde968be2d4e89c592899fad3ab445c53883fbabc11647783541e396702f4ab92e29e69d0350b
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2236-137-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Inquiry List Info.exedescription pid process target process PID 4044 set thread context of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Inquiry List Info.exepowershell.exepid process 2236 Inquiry List Info.exe 2236 Inquiry List Info.exe 4464 powershell.exe 4464 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Inquiry List Info.exepowershell.exedescription pid process Token: SeDebugPrivilege 2236 Inquiry List Info.exe Token: SeDebugPrivilege 4464 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Inquiry List Info.exeInquiry List Info.execmd.exedescription pid process target process PID 4044 wrote to memory of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe PID 4044 wrote to memory of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe PID 4044 wrote to memory of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe PID 4044 wrote to memory of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe PID 4044 wrote to memory of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe PID 4044 wrote to memory of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe PID 4044 wrote to memory of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe PID 4044 wrote to memory of 2236 4044 Inquiry List Info.exe Inquiry List Info.exe PID 2236 wrote to memory of 4108 2236 Inquiry List Info.exe cmd.exe PID 2236 wrote to memory of 4108 2236 Inquiry List Info.exe cmd.exe PID 2236 wrote to memory of 4108 2236 Inquiry List Info.exe cmd.exe PID 4108 wrote to memory of 4464 4108 cmd.exe powershell.exe PID 4108 wrote to memory of 4464 4108 cmd.exe powershell.exe PID 4108 wrote to memory of 4464 4108 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inquiry List Info.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry List Info.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry List Info.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry List Info.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Inquiry List Info.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Inquiry List Info.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inquiry List Info.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
memory/2236-136-0x0000000000000000-mapping.dmp
-
memory/2236-137-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2236-139-0x0000000005840000-0x00000000058A6000-memory.dmpFilesize
408KB
-
memory/4044-130-0x0000000000750000-0x0000000000882000-memory.dmpFilesize
1.2MB
-
memory/4044-131-0x0000000005270000-0x000000000530C000-memory.dmpFilesize
624KB
-
memory/4044-132-0x00000000058E0000-0x0000000005E84000-memory.dmpFilesize
5.6MB
-
memory/4044-133-0x0000000005330000-0x00000000053C2000-memory.dmpFilesize
584KB
-
memory/4044-134-0x0000000005200000-0x000000000520A000-memory.dmpFilesize
40KB
-
memory/4044-135-0x0000000005520000-0x0000000005576000-memory.dmpFilesize
344KB
-
memory/4108-140-0x0000000000000000-mapping.dmp
-
memory/4464-141-0x0000000000000000-mapping.dmp
-
memory/4464-142-0x0000000002DF0000-0x0000000002E26000-memory.dmpFilesize
216KB
-
memory/4464-143-0x00000000059F0000-0x0000000006018000-memory.dmpFilesize
6.2MB
-
memory/4464-144-0x0000000005940000-0x0000000005962000-memory.dmpFilesize
136KB
-
memory/4464-145-0x0000000006090000-0x00000000060F6000-memory.dmpFilesize
408KB
-
memory/4464-146-0x0000000006700000-0x000000000671E000-memory.dmpFilesize
120KB
-
memory/4464-147-0x0000000007F50000-0x00000000085CA000-memory.dmpFilesize
6.5MB
-
memory/4464-148-0x0000000006BF0000-0x0000000006C0A000-memory.dmpFilesize
104KB
-
memory/4464-149-0x0000000007970000-0x0000000007A06000-memory.dmpFilesize
600KB
-
memory/4464-150-0x00000000078D0000-0x00000000078F2000-memory.dmpFilesize
136KB