Analysis
-
max time kernel
70s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-12-2020 06:42
Static task
static1
Behavioral task
behavioral1
Sample
70A12162020.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
70A12162020.doc
Resource
win10v20201028
General
-
Target
70A12162020.doc
-
Size
526KB
-
MD5
ed75e6e71d66d381295826453ae631e0
-
SHA1
b7c29ebe55ac21e5893cdb332b72761ed6441cd9
-
SHA256
320592aa53514c7fd425f4c691e4be802ca964955d5a6fdd960a8725c36737b4
-
SHA512
07f69b17d5c75db4f4151712648b5d2cae0849f0593f8cac5a22548f4eda64455c0847f2e424b5f05faa3f69b96cdd861087919c4eafc0a764b63cff3eef9682
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-14-0x000000000048162E-mapping.dmp family_masslogger behavioral1/memory/1684-13-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1684-16-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1684-17-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1632 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
VOD.exeVOD.exepid process 1096 VOD.exe 1684 VOD.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
VOD.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\International\Geo\Nation VOD.exe -
Loads dropped DLL 2 IoCs
Processes:
EQNEDT32.EXEpid process 1632 EQNEDT32.EXE 1632 EQNEDT32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
VOD.exepid process 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
VOD.exedescription pid process target process PID 1096 set thread context of 1684 1096 VOD.exe VOD.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 328 timeout.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEVOD.exepid process 2012 WINWORD.EXE 1684 VOD.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
VOD.exeVOD.exepid process 1096 VOD.exe 1096 VOD.exe 1096 VOD.exe 1684 VOD.exe 1684 VOD.exe 1684 VOD.exe 1684 VOD.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
VOD.exeVOD.exedescription pid process Token: SeDebugPrivilege 1096 VOD.exe Token: SeDebugPrivilege 1684 VOD.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WINWORD.EXEVOD.exepid process 2012 WINWORD.EXE 2012 WINWORD.EXE 1684 VOD.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
EQNEDT32.EXEVOD.execmd.exedescription pid process target process PID 1632 wrote to memory of 1096 1632 EQNEDT32.EXE VOD.exe PID 1632 wrote to memory of 1096 1632 EQNEDT32.EXE VOD.exe PID 1632 wrote to memory of 1096 1632 EQNEDT32.EXE VOD.exe PID 1632 wrote to memory of 1096 1632 EQNEDT32.EXE VOD.exe PID 1096 wrote to memory of 1936 1096 VOD.exe cmd.exe PID 1096 wrote to memory of 1936 1096 VOD.exe cmd.exe PID 1096 wrote to memory of 1936 1096 VOD.exe cmd.exe PID 1096 wrote to memory of 1936 1096 VOD.exe cmd.exe PID 1936 wrote to memory of 328 1936 cmd.exe timeout.exe PID 1936 wrote to memory of 328 1936 cmd.exe timeout.exe PID 1936 wrote to memory of 328 1936 cmd.exe timeout.exe PID 1936 wrote to memory of 328 1936 cmd.exe timeout.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe PID 1096 wrote to memory of 1684 1096 VOD.exe VOD.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\70A12162020.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\VOD.exe"C:\Users\Admin\AppData\Roaming\VOD.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.1043⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 4.1044⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\VOD.exe"C:\Users\Admin\AppData\Roaming\VOD.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\VOD.exeMD5
37e17f5944c1eff2b5231f6e59539059
SHA17592c89af32b9acda3c165670b2447863c762178
SHA25629eb1cc47e1691ce931b66a745b10f88dff84fbdd8b8ec7b407137c362a9154f
SHA5123f117d7a16a94ac1ba1964ecd68877f9c496cd0691e275671fc71bb9e5ce4467fb7d01af81d49cf340002f3ed8aa3717fd3300e32b698f7d28261eabfb51ab9b
-
C:\Users\Admin\AppData\Roaming\VOD.exeMD5
37e17f5944c1eff2b5231f6e59539059
SHA17592c89af32b9acda3c165670b2447863c762178
SHA25629eb1cc47e1691ce931b66a745b10f88dff84fbdd8b8ec7b407137c362a9154f
SHA5123f117d7a16a94ac1ba1964ecd68877f9c496cd0691e275671fc71bb9e5ce4467fb7d01af81d49cf340002f3ed8aa3717fd3300e32b698f7d28261eabfb51ab9b
-
C:\Users\Admin\AppData\Roaming\VOD.exeMD5
37e17f5944c1eff2b5231f6e59539059
SHA17592c89af32b9acda3c165670b2447863c762178
SHA25629eb1cc47e1691ce931b66a745b10f88dff84fbdd8b8ec7b407137c362a9154f
SHA5123f117d7a16a94ac1ba1964ecd68877f9c496cd0691e275671fc71bb9e5ce4467fb7d01af81d49cf340002f3ed8aa3717fd3300e32b698f7d28261eabfb51ab9b
-
\Users\Admin\AppData\Roaming\VOD.exeMD5
37e17f5944c1eff2b5231f6e59539059
SHA17592c89af32b9acda3c165670b2447863c762178
SHA25629eb1cc47e1691ce931b66a745b10f88dff84fbdd8b8ec7b407137c362a9154f
SHA5123f117d7a16a94ac1ba1964ecd68877f9c496cd0691e275671fc71bb9e5ce4467fb7d01af81d49cf340002f3ed8aa3717fd3300e32b698f7d28261eabfb51ab9b
-
\Users\Admin\AppData\Roaming\VOD.exeMD5
37e17f5944c1eff2b5231f6e59539059
SHA17592c89af32b9acda3c165670b2447863c762178
SHA25629eb1cc47e1691ce931b66a745b10f88dff84fbdd8b8ec7b407137c362a9154f
SHA5123f117d7a16a94ac1ba1964ecd68877f9c496cd0691e275671fc71bb9e5ce4467fb7d01af81d49cf340002f3ed8aa3717fd3300e32b698f7d28261eabfb51ab9b
-
memory/328-11-0x0000000000000000-mapping.dmp
-
memory/1096-8-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1096-4-0x0000000000000000-mapping.dmp
-
memory/1096-12-0x0000000000550000-0x00000000005DF000-memory.dmpFilesize
572KB
-
memory/1096-7-0x000000006B8F0000-0x000000006BFDE000-memory.dmpFilesize
6.9MB
-
memory/1096-18-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1684-14-0x000000000048162E-mapping.dmp
-
memory/1684-13-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1684-16-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1684-17-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1684-19-0x000000006B8F0000-0x000000006BFDE000-memory.dmpFilesize
6.9MB
-
memory/1936-10-0x0000000000000000-mapping.dmp