Overview

overview

10

Static

static

a2b4d46606...bf.exe

windows7-x64

10

a2b4d46606...bf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    80s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220718-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-07-2022 09:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe

  • Size

    819KB

  • MD5

    0f2e4a2aefff2c984d82f29ce834669f

  • SHA1

    fbe05d756e7040b385adb24e22267da7038845b5

  • SHA256

    a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf

  • SHA512

    56430acc54b1d79b153e1ada48b2b19bf3e51f6dea5aee201bfa7332604f9a784fee2bdb592e0ad0fc4a91d2d155a4c41bea9b5b70bf7bc0687862b70fb7bb85

Score
10/10
massloggerspywarestealer

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe
    "C:\Users\Admin\AppData\Local\Temp\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe
      "C:\Users\Admin\AppData\Local\Temp\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe"
      2⤵
        PID:4632
      • C:\Users\Admin\AppData\Local\Temp\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe
        "C:\Users\Admin\AppData\Local\Temp\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe' & exit
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:432
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe'
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1832

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf.exe.log
      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

      Download Submit
    • memory/432-140-0x0000000000000000-mapping.dmp
      Download
    • memory/1832-145-0x0000000005580000-0x00000000055E6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/1832-142-0x0000000002320000-0x0000000002356000-memory.dmp
      Filesize

      216KB

      Download
    • memory/1832-150-0x0000000006E30000-0x0000000006E52000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1832-149-0x0000000006EA0000-0x0000000006F36000-memory.dmp
      Filesize

      600KB

      Download
    • memory/1832-148-0x0000000006D60000-0x0000000006D7A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/1832-147-0x00000000073B0000-0x0000000007A2A000-memory.dmp
      Filesize

      6.5MB

      Download
    • memory/1832-146-0x0000000005CB0000-0x0000000005CCE000-memory.dmp
      Filesize

      120KB

      Download
    • memory/1832-144-0x0000000004D90000-0x0000000004DB2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1832-143-0x0000000004F50000-0x0000000005578000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/1832-141-0x0000000000000000-mapping.dmp
      Download
    • memory/1888-130-0x0000000000320000-0x00000000003F4000-memory.dmp
      Filesize

      848KB

      Download
    • memory/1888-131-0x0000000005250000-0x00000000057F4000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/1888-133-0x0000000004F40000-0x0000000004F4A000-memory.dmp
      Filesize

      40KB

      Download
    • memory/1888-132-0x0000000004D90000-0x0000000004E22000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1888-134-0x0000000007380000-0x000000000741C000-memory.dmp
      Filesize

      624KB

      Download
    • memory/3060-139-0x0000000005700000-0x0000000005766000-memory.dmp
      Filesize

      408KB

      Download
    • memory/3060-137-0x0000000000400000-0x0000000000484000-memory.dmp
      Filesize

      528KB

      Download
    • memory/3060-136-0x0000000000000000-mapping.dmp
      Download
    • memory/4632-135-0x0000000000000000-mapping.dmp
      Download