Analysis
-
max time kernel
127s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2022 02:01
Static task
static1
Behavioral task
behavioral1
Sample
9239826853_awb_20221221_514_20221221.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9239826853_awb_20221221_514_20221221.exe
Resource
win10v2004-20221111-en
General
-
Target
9239826853_awb_20221221_514_20221221.exe
-
Size
576KB
-
MD5
a27337fabd21bf9cd0eb1b339109c62c
-
SHA1
8a4c92e398aacafe78987caefe5bc55f984a41ec
-
SHA256
00b8e2f4f20cea62efb3ffaf667f36ca4afaeffd3f7ccc5762d753422503be1e
-
SHA512
09bda15ceb928d57295407187290dbc21f26d08a64a8ab4fe564cabf306b928d42fe50bb554e9efdb59d833cec96a4fe513c588fca7737a274eb9a3b1fa5d0d1
-
SSDEEP
12288:fglVoI8ntiqXOsZtMgBzsSJ/zaGvkRUPFSUEWqf4sLrK9:6qJMGHlza4FS/X2
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4072-139-0x0000000000400000-0x0000000000494000-memory.dmp family_masslogger behavioral2/memory/4072-144-0x0000000000400000-0x0000000000494000-memory.dmp family_masslogger -
Executes dropped EXE 2 IoCs
Processes:
cxfogupuk.execxfogupuk.exepid process 3356 cxfogupuk.exe 4072 cxfogupuk.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cxfogupuk.exedescription pid process target process PID 3356 set thread context of 4072 3356 cxfogupuk.exe cxfogupuk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cxfogupuk.exepowershell.exepid process 4072 cxfogupuk.exe 4072 cxfogupuk.exe 2116 powershell.exe 2116 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
cxfogupuk.exepid process 3356 cxfogupuk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cxfogupuk.exepowershell.exedescription pid process Token: SeDebugPrivilege 4072 cxfogupuk.exe Token: SeDebugPrivilege 2116 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
9239826853_awb_20221221_514_20221221.execxfogupuk.execxfogupuk.execmd.exedescription pid process target process PID 4888 wrote to memory of 3356 4888 9239826853_awb_20221221_514_20221221.exe cxfogupuk.exe PID 4888 wrote to memory of 3356 4888 9239826853_awb_20221221_514_20221221.exe cxfogupuk.exe PID 4888 wrote to memory of 3356 4888 9239826853_awb_20221221_514_20221221.exe cxfogupuk.exe PID 3356 wrote to memory of 4072 3356 cxfogupuk.exe cxfogupuk.exe PID 3356 wrote to memory of 4072 3356 cxfogupuk.exe cxfogupuk.exe PID 3356 wrote to memory of 4072 3356 cxfogupuk.exe cxfogupuk.exe PID 3356 wrote to memory of 4072 3356 cxfogupuk.exe cxfogupuk.exe PID 4072 wrote to memory of 3380 4072 cxfogupuk.exe cmd.exe PID 4072 wrote to memory of 3380 4072 cxfogupuk.exe cmd.exe PID 4072 wrote to memory of 3380 4072 cxfogupuk.exe cmd.exe PID 3380 wrote to memory of 2116 3380 cmd.exe powershell.exe PID 3380 wrote to memory of 2116 3380 cmd.exe powershell.exe PID 3380 wrote to memory of 2116 3380 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9239826853_awb_20221221_514_20221221.exe"C:\Users\Admin\AppData\Local\Temp\9239826853_awb_20221221_514_20221221.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe"C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe" C:\Users\Admin\AppData\Local\Temp\bamlymvxaz.po2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe"C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe' & exit4⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5cfc7faa259afbcdd25b25faf32a6ff72
SHA12ed51569eb86f35e7ef01c6167c30f0327f90e64
SHA25667bbf3441bf6dd136ebfbfb9d4436dc401058b5f573145a9ea4dcaca68b77ef8
SHA512c457fbd2b624755277185b11c2824018bb9aabdaeca1cfc0420ec74e8f119a9dc73c31363340fcad2cee906d6b66bc71c203696a23f6f70d399fa96eb1a38c4d
-
Filesize
104KB
MD5cb8090344fbb5f454e495b8c0018f126
SHA137b532bbf05c43522c5ae0669440429ffa538c02
SHA25651c8ee761dffd021a6d87a89ebc7cbca5d868ce227c992ce82102fd1c0345328
SHA51202fad87643ceb02bae2abd3d58073ad390cfaaaea9ed6c32b0e9723851da0b5021e09339edee54c5c7ecbaf334673bfebbe8452bb0cf30764c75824e456d719b
-
Filesize
104KB
MD5cb8090344fbb5f454e495b8c0018f126
SHA137b532bbf05c43522c5ae0669440429ffa538c02
SHA25651c8ee761dffd021a6d87a89ebc7cbca5d868ce227c992ce82102fd1c0345328
SHA51202fad87643ceb02bae2abd3d58073ad390cfaaaea9ed6c32b0e9723851da0b5021e09339edee54c5c7ecbaf334673bfebbe8452bb0cf30764c75824e456d719b
-
Filesize
104KB
MD5cb8090344fbb5f454e495b8c0018f126
SHA137b532bbf05c43522c5ae0669440429ffa538c02
SHA25651c8ee761dffd021a6d87a89ebc7cbca5d868ce227c992ce82102fd1c0345328
SHA51202fad87643ceb02bae2abd3d58073ad390cfaaaea9ed6c32b0e9723851da0b5021e09339edee54c5c7ecbaf334673bfebbe8452bb0cf30764c75824e456d719b
-
Filesize
577KB
MD53f3e36ecf1d2a40322cdc6e03a91abec
SHA1e2a2049f42e12bf8294f51932b7ab66d3fe758fd
SHA2561b16301b40062741d9252f07d7a3c6633fec23a5d57eff6527aeafcdd56d37e1
SHA512cd7ccc51dca3bb8afde51e3a457c54b98a23ba9483a37d880a7fac625a4f537c3e51230d0e61e87effa298cb2ed30a203ab3c604628972fca92776680468027b