Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 21:23
Static task
static1
Behavioral task
behavioral1
Sample
Purchae required and shipment details.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Purchae required and shipment details.exe
Resource
win10v2004-20220414-en
General
-
Target
Purchae required and shipment details.exe
-
Size
640KB
-
MD5
6ef86a2fb28358e7aeb510c0aa82191b
-
SHA1
f81b6ea45f4c1abc82997f36b6ed57649063a701
-
SHA256
41df7c7f04b04ac0f2eb88f099c9df36f01e11eaff1c189573f49054758d653d
-
SHA512
2adb642a7ce5e3dc3411c4ed9d368b7e3331ef7340c09b339573ce661fe2a922a1fc61e1b998f795439834de66f33dd470fe86891f3336ef2e7efe54927b3359
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4044-136-0x0000000000400000-0x000000000048E000-memory.dmp family_masslogger -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchae required and shipment details.exedescription pid process target process PID 3560 set thread context of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 992 powershell.exe 992 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 992 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Purchae required and shipment details.exePurchae required and shipment details.execmd.exedescription pid process target process PID 3560 wrote to memory of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe PID 3560 wrote to memory of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe PID 3560 wrote to memory of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe PID 3560 wrote to memory of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe PID 3560 wrote to memory of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe PID 3560 wrote to memory of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe PID 3560 wrote to memory of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe PID 3560 wrote to memory of 4044 3560 Purchae required and shipment details.exe Purchae required and shipment details.exe PID 4044 wrote to memory of 4900 4044 Purchae required and shipment details.exe cmd.exe PID 4044 wrote to memory of 4900 4044 Purchae required and shipment details.exe cmd.exe PID 4044 wrote to memory of 4900 4044 Purchae required and shipment details.exe cmd.exe PID 4900 wrote to memory of 992 4900 cmd.exe powershell.exe PID 4900 wrote to memory of 992 4900 cmd.exe powershell.exe PID 4900 wrote to memory of 992 4900 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchae required and shipment details.exe"C:\Users\Admin\AppData\Local\Temp\Purchae required and shipment details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchae required and shipment details.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Purchae required and shipment details.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Purchae required and shipment details.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchae required and shipment details.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
memory/992-145-0x0000000005D50000-0x0000000005D6E000-memory.dmpFilesize
120KB
-
memory/992-144-0x0000000005570000-0x00000000055D6000-memory.dmpFilesize
408KB
-
memory/992-140-0x0000000000000000-mapping.dmp
-
memory/992-148-0x0000000006FC0000-0x0000000007056000-memory.dmpFilesize
600KB
-
memory/992-147-0x0000000006250000-0x000000000626A000-memory.dmpFilesize
104KB
-
memory/992-146-0x00000000075A0000-0x0000000007C1A000-memory.dmpFilesize
6.5MB
-
memory/992-143-0x0000000004C80000-0x0000000004CA2000-memory.dmpFilesize
136KB
-
memory/992-141-0x0000000002420000-0x0000000002456000-memory.dmpFilesize
216KB
-
memory/992-142-0x0000000004F40000-0x0000000005568000-memory.dmpFilesize
6.2MB
-
memory/992-149-0x0000000006310000-0x0000000006332000-memory.dmpFilesize
136KB
-
memory/3560-133-0x0000000005910000-0x000000000591A000-memory.dmpFilesize
40KB
-
memory/3560-131-0x0000000005DD0000-0x0000000006374000-memory.dmpFilesize
5.6MB
-
memory/3560-132-0x0000000005750000-0x00000000057E2000-memory.dmpFilesize
584KB
-
memory/3560-130-0x0000000000D10000-0x0000000000DB6000-memory.dmpFilesize
664KB
-
memory/3560-134-0x00000000095F0000-0x000000000968C000-memory.dmpFilesize
624KB
-
memory/4044-138-0x0000000005980000-0x00000000059E6000-memory.dmpFilesize
408KB
-
memory/4044-136-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4044-135-0x0000000000000000-mapping.dmp
-
memory/4900-139-0x0000000000000000-mapping.dmp