Analysis
-
max time kernel
91s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:15
Static task
static1
Behavioral task
behavioral1
Sample
Order 3278526429.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order 3278526429.exe
Resource
win10v2004-20220414-en
General
-
Target
Order 3278526429.exe
-
Size
838KB
-
MD5
01ff671b42bdd3445280155368508a36
-
SHA1
3ea0d6fed3ca6b576561c451bc412e9b7a7edeef
-
SHA256
e0cb934757cefba44fd4713fc5b5526eb461c0a55c27cb9fd31fca7690e62bc6
-
SHA512
d9806017b2020e2edda538a7165c2ca330201810dc06e4a432fbf6320355f5ff01693d7ceb620cced3ca8e8e723532b6b9f140f46288017d50e653b16ab5aa78
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1712-132-0x0000000000400000-0x00000000004A8000-memory.dmp family_masslogger -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order 3278526429.exedescription pid process target process PID 4788 set thread context of 1712 4788 Order 3278526429.exe Order 3278526429.exe -
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
dw20.exedescription pid process Token: SeRestorePrivilege 2368 dw20.exe Token: SeBackupPrivilege 2368 dw20.exe Token: SeBackupPrivilege 2368 dw20.exe Token: SeBackupPrivilege 2368 dw20.exe Token: SeBackupPrivilege 2368 dw20.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Order 3278526429.exeOrder 3278526429.exedescription pid process target process PID 4788 wrote to memory of 1712 4788 Order 3278526429.exe Order 3278526429.exe PID 4788 wrote to memory of 1712 4788 Order 3278526429.exe Order 3278526429.exe PID 4788 wrote to memory of 1712 4788 Order 3278526429.exe Order 3278526429.exe PID 4788 wrote to memory of 1712 4788 Order 3278526429.exe Order 3278526429.exe PID 4788 wrote to memory of 1712 4788 Order 3278526429.exe Order 3278526429.exe PID 4788 wrote to memory of 1712 4788 Order 3278526429.exe Order 3278526429.exe PID 4788 wrote to memory of 1712 4788 Order 3278526429.exe Order 3278526429.exe PID 4788 wrote to memory of 1712 4788 Order 3278526429.exe Order 3278526429.exe PID 1712 wrote to memory of 2368 1712 Order 3278526429.exe dw20.exe PID 1712 wrote to memory of 2368 1712 Order 3278526429.exe dw20.exe PID 1712 wrote to memory of 2368 1712 Order 3278526429.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order 3278526429.exe"C:\Users\Admin\AppData\Local\Temp\Order 3278526429.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order 3278526429.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7523⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1712-131-0x0000000000000000-mapping.dmp
-
memory/1712-132-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1712-134-0x0000000074A40000-0x0000000074FF1000-memory.dmpFilesize
5.7MB
-
memory/2368-133-0x0000000000000000-mapping.dmp
-
memory/4788-130-0x0000000074A40000-0x0000000074FF1000-memory.dmpFilesize
5.7MB