Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
17-08-2023 12:45
General
-
Target
DHLINV1708023 - 1301512300.exe
-
Size
998KB
-
MD5
d36de44bf023570b2f83fde6e95842dd
-
SHA1
b9200cb7cbf75f8f399ec7752a7dfaef5f3acf12
-
SHA256
29ea2e83d8bb49b7b646895e04c08bf60760a79cec2d761ccbee7704216323cf
-
SHA512
2b8847f1dfcdc4fdddd0a6830e61f56776f1f1335418b5c73fa49a760ed32003a77a0829ea712e81aac81457425079183cc6fc6912a35dbfc61d78c946530ffd
-
SSDEEP
12288:g2iNsXDl+CPLnid2sxF+pAz127hoc5etv4GuHkkz0FxycEgh2uWM+kz:g1g7LQqdRQAHkkzkTh2uB+kz
Score
10/10
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 1 IoCs
-
Deletes itself 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHLINV1708023 - 1301512300.exe"C:\Users\Admin\AppData\Local\Temp\DHLINV1708023 - 1301512300.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\DHLINV1708023 - 1301512300.exe' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\DHLINV1708023 - 1301512300.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
56KB
-
Filesize
752KB
-
Filesize
528KB
-
Filesize
6.9MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB