Analysis
- max time kernel
131s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
19/03/2022, 10:24
General
- Target 957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f.exe
- Size 6.4MB
- Sample220319-mfcntafgej
- SHA256 957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f.exe"C:\Users\Admin\AppData\Local\Temp\957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f.exe"C:\Users\Admin\AppData\Local\Temp\957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f.exe"C:\Users\Admin\AppData\Local\Temp\957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\957054d7718c48af69e3ad0d10cce2f2d35cac27db36bc148e7330654ad15e0f.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1456-154-0x00000000069A0000-0x00000000069D2000-memory.dmp
memory/1456-156-0x0000000006980000-0x000000000699E000-memory.dmp
memory/1456-164-0x00000000079F0000-0x00000000079F8000-memory.dmp
memory/1456-163-0x0000000007A10000-0x0000000007A2A000-memory.dmp
memory/1456-162-0x0000000007900000-0x000000000790E000-memory.dmp
memory/1456-161-0x0000000007950000-0x00000000079E6000-memory.dmp
memory/1456-160-0x0000000007750000-0x000000000775A000-memory.dmp
memory/1456-159-0x000000007F670000-0x000000007F671000-memory.dmp
memory/1456-158-0x00000000076D0000-0x00000000076EA000-memory.dmp
memory/1456-157-0x0000000007D20000-0x000000000839A000-memory.dmp
memory/1456-149-0x0000000074E20000-0x00000000755D0000-memory.dmp
memory/1456-155-0x00000000700C0000-0x000000007010C000-memory.dmp
memory/1456-153-0x0000000004F45000-0x0000000004F47000-memory.dmp
memory/1456-144-0x0000000002A30000-0x0000000002A66000-memory.dmp
memory/1456-145-0x0000000005580000-0x0000000005BA8000-memory.dmp
memory/1456-147-0x0000000005BB0000-0x0000000005BD2000-memory.dmp
memory/1456-152-0x00000000063D0000-0x00000000063EE000-memory.dmp
memory/1456-148-0x0000000005C50000-0x0000000005CB6000-memory.dmp
memory/1456-151-0x0000000004F42000-0x0000000004F43000-memory.dmp
memory/1456-150-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/2700-131-0x0000000074E20000-0x00000000755D0000-memory.dmp
memory/2700-132-0x0000000013320000-0x00000000133BC000-memory.dmp
memory/2700-133-0x0000000006180000-0x0000000006724000-memory.dmp
memory/2700-130-0x0000000000CA0000-0x000000000130E000-memory.dmp
memory/2700-134-0x0000000003790000-0x0000000003791000-memory.dmp
memory/3704-138-0x0000000003770000-0x0000000003771000-memory.dmp
memory/3704-139-0x0000000005EB0000-0x0000000005F42000-memory.dmp
memory/3704-146-0x0000000003773000-0x0000000003775000-memory.dmp
memory/3704-137-0x0000000074E20000-0x00000000755D0000-memory.dmp
memory/3704-140-0x0000000007070000-0x00000000070D6000-memory.dmp
memory/3704-141-0x0000000072EC0000-0x0000000072ED2000-memory.dmp
memory/3704-135-0x0000000000400000-0x0000000000486000-memory.dmp
memory/3704-142-0x0000000007940000-0x000000000794A000-memory.dmp
memory/3704-143-0x00000000079F0000-0x0000000007A40000-memory.dmp