Overview

overview

10

Static

static

Enquiry N0...58.exe

windows7_x64

10

Enquiry N0...58.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Enquiry N0. 20003475758.exe

  • Size

    864KB

  • Sample

    201109-p5w6ybkcvs

  • MD5

    a7c0a6884aeeaf88165107666a42dc21

  • SHA1

    4fb34f0f8c6c99854797844114f68ac6f8b07dea

  • SHA256

    d2ae3fabca5021b33bfa9326b06dea2cc82a56537a1d473934553bdcdfaddb74

  • SHA512

    2a91c9a57fa7b5210a9b089f2d23726a1d591d903acdb69e9fc3a7898e089eb4c87f47c5d4974d3ec437f6585fc42eedc931fee2ebe04050a04a8da0b22f96c5

Score
10/10
massloggerransomwarerezer0spywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\5FADD7138A\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/11/2020 4:44:10 AM MassLogger Started: 11/11/2020 4:44:04 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Enquiry N0. 20003475758.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\109933CE9F\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/11/2020 4:44:07 AM MassLogger Started: 11/11/2020 4:44:04 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Enquiry N0. 20003475758.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

    • Target

      Enquiry N0. 20003475758.exe

    • Size

      864KB

    • MD5

      a7c0a6884aeeaf88165107666a42dc21

    • SHA1

      4fb34f0f8c6c99854797844114f68ac6f8b07dea

    • SHA256

      d2ae3fabca5021b33bfa9326b06dea2cc82a56537a1d473934553bdcdfaddb74

    • SHA512

      2a91c9a57fa7b5210a9b089f2d23726a1d591d903acdb69e9fc3a7898e089eb4c87f47c5d4974d3ec437f6585fc42eedc931fee2ebe04050a04a8da0b22f96c5

    Score
    10/10
    massloggerransomwarerezer0spywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks