| File name: | bst.exe |
| Full analysis: | https://app.any.run/tasks/e82c707e-e000-4514-8784-7c6784e5fb31 |
| Verdict: | Malicious activity |
| Threats: | MassLogger is a credential stealer and keylogger first identified in April 2020. It has been actively used in cyber campaigns to exfiltrate sensitive information from compromised systems. It is designed for easy use by less tech-savvy actors and is prominent for the capability of spreading via USB drives. It targets both individuals and organizations in various industries, mostly in Europe and the USA. |
| Analysis date: | June 26, 2020, 06:39:26 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | BEA3F1161A16A6FBC8F2FB2E7DBF0EC5 |
| SHA1: | 938C16C1C5C6C9B7282AF8C9B4ACA5F97250C142 |
| SHA256: | 3E468281DDF4A728DC41A9A4D1443B5BEDBD7614AE0F10BE0FE61BB1BACF84F3 |
| SSDEEP: | 12288:EgkZOg3imtX254oxLPj82cgNSsAjAuYcVWv:EgPgSm3oxLL82cQcAuv0 |
MALICIOUS
Stealing of credential data
- bst.exe (PID: 2268)
MASSLOGGER was detected
- bst.exe (PID: 2268)
Actions looks like stealing of personal data
- bst.exe (PID: 2268)
SUSPICIOUS
Reads Environment values
- bst.exe (PID: 2268)
Checks for external IP
- bst.exe (PID: 2268)
Checks supported languages
- bst.exe (PID: 2268)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2072:02:21 09:37:42+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 554496 |
| InitializedDataSize: | 56320 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x8946e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 5.1.0.407 |
| ProductVersionNumber: | 5.1.0.407 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | Creative Cloud Desktop |
| FileDescription: | Creative Cloud Desktop |
| FileVersion: | 5.1.0.407 |
| InternalName: | Creative Cloud Desktop |
| LegalCopyright: | © 2019 Adobe. All rights reserved. |
| LegalTrademarks: | - |
| OriginalFileName: | Creative Cloud Desktop |
| ProductName: | Adobe Inc. |
| ProductVersion: | 5.1.0.407 |
| AssemblyVersion: | 5.1.0.407 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 16-Jan-1936 02:09:26 |
| Comments: | - |
| CompanyName: | Creative Cloud Desktop |
| FileDescription: | Creative Cloud Desktop |
| FileVersion: | 5.1.0.407 |
| InternalName: | Creative Cloud Desktop |
| LegalCopyright: | © 2019 Adobe. All rights reserved. |
| LegalTrademarks: | - |
| OriginalFilename: | Creative Cloud Desktop |
| ProductName: | Adobe Inc. |
| ProductVersion: | 5.1.0.407 |
| Assembly Version: | 5.1.0.407 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 16-Jan-1936 02:09:26 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x00087474 | 0x00087600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.61917 |
.rsrc | 0x0008A000 | 0x0000D8B8 | 0x0000DA00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.33095 |
.reloc | 0x00098000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.00112 | 490 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
2 | 4.8131 | 2440 | Latin 1 / Western European | UNKNOWN | RT_ICON |
3 | 4.92949 | 4264 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4 | 4.85114 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
5 | 4.60781 | 16936 | Latin 1 / Western European | UNKNOWN | RT_ICON |
6 | 7.9596 | 18983 | Latin 1 / Western European | UNKNOWN | RT_ICON |
Imports
mscoree.dll |
Total processes
34
Monitored processes
1
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2268 | "C:\Users\admin\AppData\Local\Temp\bst.exe" | C:\Users\admin\AppData\Local\Temp\bst.exe | explorer.exe | ||||||||||||
User: admin Company: Creative Cloud Desktop Integrity Level: MEDIUM Description: Creative Cloud Desktop Exit code: 0 Version: 5.1.0.407 Modules
| |||||||||||||||
Total events
52
Read events
40
Write events
12
Delete events
0
Modification events
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2268) bst.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bst_RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
Executable files
0
Suspicious files
1
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2268 | bst.exe | C:\Users\admin\AppData\Local\Temp\D04F4D4D0D\DotNetZip-onp1j315.tmp | — | |
MD5:— | SHA256:— | |||
| 2268 | bst.exe | C:\Users\admin\AppData\Local\Temp\D04F4D4D0D\admin_United States_D04F4D4D0D_06-26-2020 7.39.54.zip | compressed | |
MD5:— | SHA256:— | |||
| 2268 | bst.exe | C:\Users\admin\AppData\Local\Temp\D04F4D4D0D\Log.txt | text | |
MD5:— | SHA256:— | |||
| 2268 | bst.exe | C:\Users\admin\AppData\Local\Temp\D04F4D4D0D\Screenshot.jpeg | image | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2268 | bst.exe | POST | 200 | 45.76.76.206:80 | http://souhtland-europe.com/green/?/upload | US | text | 26 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2268 | bst.exe | 45.76.76.206:80 | souhtland-europe.com | Choopa, LLC | US | unknown |
2268 | bst.exe | 54.235.83.248:80 | api.ipify.org | Amazon.com, Inc. | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.ipify.org |
| shared |
souhtland-europe.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2268 | bst.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup api.ipify.org |