Analysis
-
max time kernel
139s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-12-2020 14:20
Static task
static1
Behavioral task
behavioral1
Sample
OOCLU57731000013.xls.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
OOCLU57731000013.xls.exe
Resource
win10v20201028
General
-
Target
OOCLU57731000013.xls.exe
-
Size
892KB
-
MD5
7c3df39bc1a99d5b392330206083461b
-
SHA1
7f60f5dc06d5f4a91d606312747bbc770226bbb3
-
SHA256
14836e19f657b3a82b1f58dfb846ff1eb66f72ea7eb9b840c2de4b2ceeddcddd
-
SHA512
3cab1494e1a137045c0b7eb005c169fb56b26efc7754b80ff44090502c11a4f96d36b0bd403cc309e0b9fca4220bad4cdcaa8b6905483fbb9d4ec000964c9985
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3956-11-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral2/memory/3956-12-0x000000000048149E-mapping.dmp family_masslogger behavioral2/memory/1280-66-0x000000000048149E-mapping.dmp family_masslogger -
Executes dropped EXE 2 IoCs
Processes:
nslookup.exenslookup.exepid process 1480 nslookup.exe 1280 nslookup.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
OOCLU57731000013.xls.exenslookup.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation OOCLU57731000013.xls.exe Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation nslookup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 api.ipify.org 22 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
OOCLU57731000013.xls.exenslookup.exedescription pid process target process PID 4648 set thread context of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 1480 set thread context of 1280 1480 nslookup.exe nslookup.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 852 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
nslookup.exepid process 1280 nslookup.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
OOCLU57731000013.xls.exepowershell.exenslookup.exepowershell.exepid process 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 3956 OOCLU57731000013.xls.exe 1868 powershell.exe 1868 powershell.exe 1868 powershell.exe 1280 nslookup.exe 1280 nslookup.exe 1280 nslookup.exe 1280 nslookup.exe 2608 powershell.exe 2608 powershell.exe 2608 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
OOCLU57731000013.xls.exepowershell.exenslookup.exepowershell.exedescription pid process Token: SeDebugPrivilege 3956 OOCLU57731000013.xls.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 1280 nslookup.exe Token: SeDebugPrivilege 2608 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
nslookup.exepid process 1280 nslookup.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
OOCLU57731000013.xls.exeOOCLU57731000013.xls.execmd.execmd.exenslookup.exenslookup.exedescription pid process target process PID 4648 wrote to memory of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 4648 wrote to memory of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 4648 wrote to memory of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 4648 wrote to memory of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 4648 wrote to memory of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 4648 wrote to memory of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 4648 wrote to memory of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 4648 wrote to memory of 3956 4648 OOCLU57731000013.xls.exe OOCLU57731000013.xls.exe PID 3956 wrote to memory of 1868 3956 OOCLU57731000013.xls.exe powershell.exe PID 3956 wrote to memory of 1868 3956 OOCLU57731000013.xls.exe powershell.exe PID 3956 wrote to memory of 1868 3956 OOCLU57731000013.xls.exe powershell.exe PID 3956 wrote to memory of 4436 3956 OOCLU57731000013.xls.exe cmd.exe PID 3956 wrote to memory of 4436 3956 OOCLU57731000013.xls.exe cmd.exe PID 3956 wrote to memory of 4436 3956 OOCLU57731000013.xls.exe cmd.exe PID 3956 wrote to memory of 4416 3956 OOCLU57731000013.xls.exe cmd.exe PID 3956 wrote to memory of 4416 3956 OOCLU57731000013.xls.exe cmd.exe PID 3956 wrote to memory of 4416 3956 OOCLU57731000013.xls.exe cmd.exe PID 4416 wrote to memory of 852 4416 cmd.exe timeout.exe PID 4416 wrote to memory of 852 4416 cmd.exe timeout.exe PID 4416 wrote to memory of 852 4416 cmd.exe timeout.exe PID 4436 wrote to memory of 996 4436 cmd.exe schtasks.exe PID 4436 wrote to memory of 996 4436 cmd.exe schtasks.exe PID 4436 wrote to memory of 996 4436 cmd.exe schtasks.exe PID 4416 wrote to memory of 1480 4416 cmd.exe nslookup.exe PID 4416 wrote to memory of 1480 4416 cmd.exe nslookup.exe PID 4416 wrote to memory of 1480 4416 cmd.exe nslookup.exe PID 1480 wrote to memory of 1280 1480 nslookup.exe nslookup.exe PID 1480 wrote to memory of 1280 1480 nslookup.exe nslookup.exe PID 1480 wrote to memory of 1280 1480 nslookup.exe nslookup.exe PID 1480 wrote to memory of 1280 1480 nslookup.exe nslookup.exe PID 1480 wrote to memory of 1280 1480 nslookup.exe nslookup.exe PID 1480 wrote to memory of 1280 1480 nslookup.exe nslookup.exe PID 1480 wrote to memory of 1280 1480 nslookup.exe nslookup.exe PID 1480 wrote to memory of 1280 1480 nslookup.exe nslookup.exe PID 1280 wrote to memory of 2608 1280 nslookup.exe powershell.exe PID 1280 wrote to memory of 2608 1280 nslookup.exe powershell.exe PID 1280 wrote to memory of 2608 1280 nslookup.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OOCLU57731000013.xls.exe"C:\Users\Admin\AppData\Local\Temp\OOCLU57731000013.xls.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OOCLU57731000013.xls.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OOCLU57731000013.xls.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3A5A.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe"{path}"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\vilan\nslookup.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OOCLU57731000013.xls.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nslookup.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
769b5c4eeb60575e1ca180944908df1f
SHA15184105a0b15e2de71c6792c7aea818acfae336f
SHA256c63b9fb0a840fb3a097bd41e9d99fa52e64aa704f3ee6569027bb02779f623eb
SHA5120241e1589e1448e982f673fdc555dafe29955953e966291fd2407bf128b5a6cfdbd2b2833a4c2804bed9d4c4cd47f8673e20f63d0bf76122dfe0e86c80f45a16
-
C:\Users\Admin\AppData\Local\Temp\tmp3A5A.tmp.batMD5
40146b5c0ace3494d0564b5cbe84c23c
SHA1376bad085414544ebda348be39f899f6f65ae201
SHA25695601ae86cc41b44f770274ef383a93c2d02f0f91a11eef09a65cff3f7a83167
SHA512909178ffbea3048135099c38c6f5768a4973232697e983b1520f0107fb369a5e6f560998cc03a3d969318f428d68d009cda78527417dca1476408345e084c582
-
C:\Users\Admin\AppData\Roaming\vilan\nslookup.exeMD5
7c3df39bc1a99d5b392330206083461b
SHA17f60f5dc06d5f4a91d606312747bbc770226bbb3
SHA25614836e19f657b3a82b1f58dfb846ff1eb66f72ea7eb9b840c2de4b2ceeddcddd
SHA5123cab1494e1a137045c0b7eb005c169fb56b26efc7754b80ff44090502c11a4f96d36b0bd403cc309e0b9fca4220bad4cdcaa8b6905483fbb9d4ec000964c9985
-
C:\Users\Admin\AppData\Roaming\vilan\nslookup.exeMD5
7c3df39bc1a99d5b392330206083461b
SHA17f60f5dc06d5f4a91d606312747bbc770226bbb3
SHA25614836e19f657b3a82b1f58dfb846ff1eb66f72ea7eb9b840c2de4b2ceeddcddd
SHA5123cab1494e1a137045c0b7eb005c169fb56b26efc7754b80ff44090502c11a4f96d36b0bd403cc309e0b9fca4220bad4cdcaa8b6905483fbb9d4ec000964c9985
-
C:\Users\Admin\AppData\Roaming\vilan\nslookup.exeMD5
7c3df39bc1a99d5b392330206083461b
SHA17f60f5dc06d5f4a91d606312747bbc770226bbb3
SHA25614836e19f657b3a82b1f58dfb846ff1eb66f72ea7eb9b840c2de4b2ceeddcddd
SHA5123cab1494e1a137045c0b7eb005c169fb56b26efc7754b80ff44090502c11a4f96d36b0bd403cc309e0b9fca4220bad4cdcaa8b6905483fbb9d4ec000964c9985
-
memory/852-32-0x0000000000000000-mapping.dmp
-
memory/996-33-0x0000000000000000-mapping.dmp
-
memory/1280-66-0x000000000048149E-mapping.dmp
-
memory/1280-69-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/1280-77-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/1480-49-0x0000000000000000-mapping.dmp
-
memory/1480-48-0x0000000000000000-mapping.dmp
-
memory/1480-52-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/1868-31-0x00000000080A0000-0x00000000080A1000-memory.dmpFilesize
4KB
-
memory/1868-36-0x00000000086A0000-0x00000000086A1000-memory.dmpFilesize
4KB
-
memory/1868-62-0x0000000009990000-0x0000000009991000-memory.dmpFilesize
4KB
-
memory/1868-27-0x0000000007690000-0x0000000007691000-memory.dmpFilesize
4KB
-
memory/1868-28-0x0000000007730000-0x0000000007731000-memory.dmpFilesize
4KB
-
memory/1868-24-0x0000000007970000-0x0000000007971000-memory.dmpFilesize
4KB
-
memory/1868-23-0x0000000003460000-0x0000000003461000-memory.dmpFilesize
4KB
-
memory/1868-20-0x0000000000000000-mapping.dmp
-
memory/1868-22-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/1868-34-0x0000000007830000-0x0000000007831000-memory.dmpFilesize
4KB
-
memory/1868-35-0x0000000008810000-0x0000000008811000-memory.dmpFilesize
4KB
-
memory/1868-60-0x00000000099B0000-0x00000000099B1000-memory.dmpFilesize
4KB
-
memory/1868-38-0x0000000009720000-0x0000000009753000-memory.dmpFilesize
204KB
-
memory/1868-45-0x00000000094C0000-0x00000000094C1000-memory.dmpFilesize
4KB
-
memory/1868-46-0x0000000009850000-0x0000000009851000-memory.dmpFilesize
4KB
-
memory/1868-47-0x0000000009A50000-0x0000000009A51000-memory.dmpFilesize
4KB
-
memory/2608-89-0x0000000008D20000-0x0000000008D21000-memory.dmpFilesize
4KB
-
memory/2608-86-0x0000000008360000-0x0000000008361000-memory.dmpFilesize
4KB
-
memory/2608-80-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/2608-75-0x0000000000000000-mapping.dmp
-
memory/2608-100-0x0000000009C70000-0x0000000009C71000-memory.dmpFilesize
4KB
-
memory/3956-19-0x0000000006840000-0x0000000006841000-memory.dmpFilesize
4KB
-
memory/3956-12-0x000000000048149E-mapping.dmp
-
memory/3956-11-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3956-14-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/4416-26-0x0000000000000000-mapping.dmp
-
memory/4436-25-0x0000000000000000-mapping.dmp
-
memory/4648-8-0x0000000008D00000-0x0000000008D01000-memory.dmpFilesize
4KB
-
memory/4648-6-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/4648-5-0x0000000005CC0000-0x0000000005CC1000-memory.dmpFilesize
4KB
-
memory/4648-7-0x0000000003360000-0x0000000003361000-memory.dmpFilesize
4KB
-
memory/4648-9-0x0000000005B70000-0x0000000005B74000-memory.dmpFilesize
16KB
-
memory/4648-3-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/4648-2-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/4648-10-0x0000000009020000-0x00000000090BE000-memory.dmpFilesize
632KB