Analysis
-
max time kernel
121s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-12-2020 07:14
Static task
static1
Behavioral task
behavioral1
Sample
Quote.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Quote.doc
Resource
win10v20201028
General
-
Target
Quote.doc
-
Size
323KB
-
MD5
b7ce7ad9f6a6a4d898f9851e92e7dd9c
-
SHA1
a7cefdad7e19a306662ee6c00e058ebe43b9fcf9
-
SHA256
a184462faa2f3a2a82439e7902fb5d47f4a6a784cff86931fb69ece85ad5d5e0
-
SHA512
c266b17883891d194f002c28d81960922d8633cbb08094f590f92b2c6023248d0f6821d7b62655635e48c0629e3daaaa0b12cb79f202b376868fbf21e068dc47
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1212-14-0x000000000048162E-mapping.dmp family_masslogger behavioral1/memory/1212-13-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1212-16-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1212-17-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1476 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
ATR.exeATR.exepid process 1716 ATR.exe 1212 ATR.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ATR.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation ATR.exe -
Loads dropped DLL 2 IoCs
Processes:
EQNEDT32.EXEpid process 1476 EQNEDT32.EXE 1476 EQNEDT32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ATR.exedescription pid process target process PID 1716 set thread context of 1212 1716 ATR.exe ATR.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1540 timeout.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEATR.exepid process 1876 WINWORD.EXE 1212 ATR.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ATR.exepid process 1212 ATR.exe 1212 ATR.exe 1212 ATR.exe 1212 ATR.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ATR.exeATR.exedescription pid process Token: SeDebugPrivilege 1716 ATR.exe Token: SeDebugPrivilege 1212 ATR.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WINWORD.EXEATR.exepid process 1876 WINWORD.EXE 1876 WINWORD.EXE 1212 ATR.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
EQNEDT32.EXEATR.execmd.exedescription pid process target process PID 1476 wrote to memory of 1716 1476 EQNEDT32.EXE ATR.exe PID 1476 wrote to memory of 1716 1476 EQNEDT32.EXE ATR.exe PID 1476 wrote to memory of 1716 1476 EQNEDT32.EXE ATR.exe PID 1476 wrote to memory of 1716 1476 EQNEDT32.EXE ATR.exe PID 1716 wrote to memory of 816 1716 ATR.exe cmd.exe PID 1716 wrote to memory of 816 1716 ATR.exe cmd.exe PID 1716 wrote to memory of 816 1716 ATR.exe cmd.exe PID 1716 wrote to memory of 816 1716 ATR.exe cmd.exe PID 816 wrote to memory of 1540 816 cmd.exe timeout.exe PID 816 wrote to memory of 1540 816 cmd.exe timeout.exe PID 816 wrote to memory of 1540 816 cmd.exe timeout.exe PID 816 wrote to memory of 1540 816 cmd.exe timeout.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe PID 1716 wrote to memory of 1212 1716 ATR.exe ATR.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Quote.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ATR.exe"C:\Users\Admin\AppData\Roaming\ATR.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.153⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 4.154⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ATR.exe"C:\Users\Admin\AppData\Roaming\ATR.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ATR.exeMD5
10878a47c843003ba5ded096572e0aea
SHA15b96ecdb5213e835bf68de80f296e4c9f3b9a80c
SHA256062998d4a777d031127504c56bfdca3386b79112a5ac822d982fad844ea44ee1
SHA51250fd47504fa91b3b94242ec8c4c5875aef9511aa5788624f17f8809c91a378cf7e5fa00dd7c058ed12d4b1f3e9bd89a206bce2d218fafdcbc9af800e30c4e148
-
C:\Users\Admin\AppData\Roaming\ATR.exeMD5
10878a47c843003ba5ded096572e0aea
SHA15b96ecdb5213e835bf68de80f296e4c9f3b9a80c
SHA256062998d4a777d031127504c56bfdca3386b79112a5ac822d982fad844ea44ee1
SHA51250fd47504fa91b3b94242ec8c4c5875aef9511aa5788624f17f8809c91a378cf7e5fa00dd7c058ed12d4b1f3e9bd89a206bce2d218fafdcbc9af800e30c4e148
-
C:\Users\Admin\AppData\Roaming\ATR.exeMD5
10878a47c843003ba5ded096572e0aea
SHA15b96ecdb5213e835bf68de80f296e4c9f3b9a80c
SHA256062998d4a777d031127504c56bfdca3386b79112a5ac822d982fad844ea44ee1
SHA51250fd47504fa91b3b94242ec8c4c5875aef9511aa5788624f17f8809c91a378cf7e5fa00dd7c058ed12d4b1f3e9bd89a206bce2d218fafdcbc9af800e30c4e148
-
\Users\Admin\AppData\Roaming\ATR.exeMD5
10878a47c843003ba5ded096572e0aea
SHA15b96ecdb5213e835bf68de80f296e4c9f3b9a80c
SHA256062998d4a777d031127504c56bfdca3386b79112a5ac822d982fad844ea44ee1
SHA51250fd47504fa91b3b94242ec8c4c5875aef9511aa5788624f17f8809c91a378cf7e5fa00dd7c058ed12d4b1f3e9bd89a206bce2d218fafdcbc9af800e30c4e148
-
\Users\Admin\AppData\Roaming\ATR.exeMD5
10878a47c843003ba5ded096572e0aea
SHA15b96ecdb5213e835bf68de80f296e4c9f3b9a80c
SHA256062998d4a777d031127504c56bfdca3386b79112a5ac822d982fad844ea44ee1
SHA51250fd47504fa91b3b94242ec8c4c5875aef9511aa5788624f17f8809c91a378cf7e5fa00dd7c058ed12d4b1f3e9bd89a206bce2d218fafdcbc9af800e30c4e148
-
memory/816-10-0x0000000000000000-mapping.dmp
-
memory/1212-16-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1212-18-0x000000006A7F0000-0x000000006AEDE000-memory.dmpFilesize
6.9MB
-
memory/1212-17-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1212-14-0x000000000048162E-mapping.dmp
-
memory/1212-13-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1540-11-0x0000000000000000-mapping.dmp
-
memory/1716-12-0x00000000006B0000-0x0000000000737000-memory.dmpFilesize
540KB
-
memory/1716-4-0x0000000000000000-mapping.dmp
-
memory/1716-8-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/1716-7-0x000000006B120000-0x000000006B80E000-memory.dmpFilesize
6.9MB