Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:20
General
-
Target
Order Inquiry with Design Samples.exe
-
Size
897KB
-
MD5
2ebff22a63913f818834de7c54a0e354
-
SHA1
89a9d6a4d974fe7cde6ec896c5dc19283b0f63f4
-
SHA256
2302005fdd7c57d73c350d541fd0020b051efffdf02a4f3c3e1671cacea30043
-
SHA512
f722929d3691cda5d078f477c6ecac777b465d0923931fcc62389a4b6b6ed1df35b6be2800ce9cf9e2c65b004adf85d7822a12c0ad07d13e6c05139c5f2c4dda
Score
10/10
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry with Design Samples.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry with Design Samples.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry with Design Samples.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry with Design Samples.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry with Design Samples.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry with Design Samples.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Order Inquiry with Design Samples.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Order Inquiry with Design Samples.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1916-139-0x0000000000000000-mapping.dmp
-
memory/1916-148-0x0000000006DA0000-0x0000000006DC2000-memory.dmpFilesize
136KB
-
memory/1916-147-0x0000000007A60000-0x0000000007AF6000-memory.dmpFilesize
600KB
-
memory/1916-146-0x0000000006CD0000-0x0000000006CEA000-memory.dmpFilesize
104KB
-
memory/1916-145-0x0000000007E40000-0x00000000084BA000-memory.dmpFilesize
6.5MB
-
memory/1916-144-0x00000000067E0000-0x00000000067FE000-memory.dmpFilesize
120KB
-
memory/1916-143-0x0000000006070000-0x00000000060D6000-memory.dmpFilesize
408KB
-
memory/1916-140-0x0000000005180000-0x00000000051B6000-memory.dmpFilesize
216KB
-
memory/1916-141-0x0000000005830000-0x0000000005E58000-memory.dmpFilesize
6.2MB
-
memory/1916-142-0x0000000005FD0000-0x0000000005FF2000-memory.dmpFilesize
136KB
-
memory/2400-135-0x0000000000000000-mapping.dmp
-
memory/2400-136-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2400-137-0x0000000004FB0000-0x0000000005016000-memory.dmpFilesize
408KB
-
memory/2996-134-0x0000000000000000-mapping.dmp
-
memory/3920-130-0x0000000000110000-0x00000000001F6000-memory.dmpFilesize
920KB
-
memory/3920-133-0x0000000004E50000-0x0000000004EEC000-memory.dmpFilesize
624KB
-
memory/3920-132-0x0000000004C30000-0x0000000004CC2000-memory.dmpFilesize
584KB
-
memory/3920-131-0x00000000051E0000-0x0000000005784000-memory.dmpFilesize
5.6MB
-
memory/5052-138-0x0000000000000000-mapping.dmp