General

  • Target

    Sulfasalazine-Granule.com

  • Size

    803KB

  • Sample

    201125-2v4tyzn7tj

  • MD5

    a82ab8231c353321f45069ed7ce6651b

  • SHA1

    200c3a819fa6cc67558963b636e33bc8adca886a

  • SHA256

    e93cf93e8ff851cd540fa165166665bbb0f5bfd1103166686230e9cb810caa05

  • SHA512

    12744af23d93ff4f3bdf2b6de48bdc85ad1a65072a642840bdd86f1af04236edc4b61c5916bf8af19b98f802ac4fd73a94b364d04cf11a747fedd74e5817121c

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\5FADD7138A\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/25/2020 11:37:46 AM MassLogger Started: 11/25/2020 11:37:40 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Sulfasalazine-Granule.com.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Window Searcher ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Extracted

Path

C:\Users\Admin\AppData\Local\7C372DB998\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/25/2020 12:44:56 PM MassLogger Started: 11/25/2020 12:44:51 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Sulfasalazine-Granule.com.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Targets

    • Target

      Sulfasalazine-Granule.com

    • Size

      803KB

    • MD5

      a82ab8231c353321f45069ed7ce6651b

    • SHA1

      200c3a819fa6cc67558963b636e33bc8adca886a

    • SHA256

      e93cf93e8ff851cd540fa165166665bbb0f5bfd1103166686230e9cb810caa05

    • SHA512

      12744af23d93ff4f3bdf2b6de48bdc85ad1a65072a642840bdd86f1af04236edc4b61c5916bf8af19b98f802ac4fd73a94b364d04cf11a747fedd74e5817121c

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks