Analysis
-
max time kernel
112s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 16:12
Static task
static1
Behavioral task
behavioral1
Sample
c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe
Resource
win10v2004-20220414-en
General
-
Target
c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe
-
Size
824KB
-
MD5
8b7df26c62ae59859e08096fd12cf199
-
SHA1
5879a5399d91a57d2327584ccce8b8654e60b642
-
SHA256
c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543
-
SHA512
ddba02b074af7b559d78b6d9423fdd7a4247f8f66a2d624605293a5789534c78e4e8dac9cc7c814970d14c338d906de71ef5951453a2911a800a0ac42a28e10d
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3584-136-0x0000000000400000-0x00000000004A8000-memory.dmp family_masslogger -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exedescription pid process target process PID 4760 set thread context of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1612 powershell.exe 1612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1612 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exec4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.execmd.exedescription pid process target process PID 4760 wrote to memory of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe PID 4760 wrote to memory of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe PID 4760 wrote to memory of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe PID 4760 wrote to memory of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe PID 4760 wrote to memory of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe PID 4760 wrote to memory of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe PID 4760 wrote to memory of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe PID 4760 wrote to memory of 3584 4760 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe PID 3584 wrote to memory of 1360 3584 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe cmd.exe PID 3584 wrote to memory of 1360 3584 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe cmd.exe PID 3584 wrote to memory of 1360 3584 c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe cmd.exe PID 1360 wrote to memory of 1612 1360 cmd.exe powershell.exe PID 1360 wrote to memory of 1612 1360 cmd.exe powershell.exe PID 1360 wrote to memory of 1612 1360 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe"C:\Users\Admin\AppData\Local\Temp\c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe"C:\Users\Admin\AppData\Local\Temp\c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c4ef4eccfd7797c2a7e0a26e237e9489e8ecdfa38d25e3d4d0b9f259470d8543.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
memory/1360-139-0x0000000000000000-mapping.dmp
-
memory/1612-145-0x00000000062C0000-0x00000000062DE000-memory.dmpFilesize
120KB
-
memory/1612-146-0x0000000007B10000-0x000000000818A000-memory.dmpFilesize
6.5MB
-
memory/1612-149-0x0000000006880000-0x00000000068A2000-memory.dmpFilesize
136KB
-
memory/1612-148-0x0000000007530000-0x00000000075C6000-memory.dmpFilesize
600KB
-
memory/1612-147-0x00000000067E0000-0x00000000067FA000-memory.dmpFilesize
104KB
-
memory/1612-140-0x0000000000000000-mapping.dmp
-
memory/1612-141-0x0000000002980000-0x00000000029B6000-memory.dmpFilesize
216KB
-
memory/1612-142-0x00000000054A0000-0x0000000005AC8000-memory.dmpFilesize
6.2MB
-
memory/1612-143-0x0000000005B40000-0x0000000005B62000-memory.dmpFilesize
136KB
-
memory/1612-144-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/3584-135-0x0000000000000000-mapping.dmp
-
memory/3584-136-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3584-138-0x0000000005740000-0x00000000057A6000-memory.dmpFilesize
408KB
-
memory/4760-132-0x0000000005810000-0x00000000058A2000-memory.dmpFilesize
584KB
-
memory/4760-130-0x0000000000D90000-0x0000000000E64000-memory.dmpFilesize
848KB
-
memory/4760-131-0x0000000005CD0000-0x0000000006274000-memory.dmpFilesize
5.6MB
-
memory/4760-133-0x00000000059C0000-0x00000000059CA000-memory.dmpFilesize
40KB
-
memory/4760-134-0x0000000008F50000-0x0000000008FEC000-memory.dmpFilesize
624KB