Analysis
-
max time kernel
4294183s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
26-03-2022 23:16
Static task
static1
Behavioral task
behavioral1
Sample
8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe
Resource
win10v2004-20220310-en
General
-
Target
8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe
-
Size
440KB
-
MD5
a3b4d25af01edf5fe34fd6e13a1381e6
-
SHA1
3a60499205fa92a581d3b6cb232fc8ed8d750088
-
SHA256
8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f
-
SHA512
d9269e5c8bbf672ef32e8f74d61bdd3abaa991a74fb092ca5dc7f9a25b8bb7cd0dc09b59b823336edcc9b18d226b9b8e518ac2ca710e2c9bd8ce5452b9ccc5b0
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
resource yara_rule behavioral1/memory/572-57-0x0000000005B00000-0x0000000005B86000-memory.dmp family_masslogger behavioral1/memory/564-78-0x0000000000370000-0x00000000003B0000-memory.dmp family_masslogger -
Executes dropped EXE 1 IoCs
pid Process 564 nslookup.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International\Geo\Nation 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe Key value queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International\Geo\Nation nslookup.exe -
Loads dropped DLL 1 IoCs
pid Process 2000 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook nslookup.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org 11 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 928 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1744 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 564 nslookup.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 1356 powershell.exe 564 nslookup.exe 564 nslookup.exe 564 nslookup.exe 564 nslookup.exe 564 nslookup.exe 564 nslookup.exe 960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeDebugPrivilege 564 nslookup.exe Token: SeDebugPrivilege 960 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 564 nslookup.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 572 wrote to memory of 1356 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 30 PID 572 wrote to memory of 1356 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 30 PID 572 wrote to memory of 1356 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 30 PID 572 wrote to memory of 1356 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 30 PID 572 wrote to memory of 548 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 32 PID 572 wrote to memory of 548 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 32 PID 572 wrote to memory of 548 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 32 PID 572 wrote to memory of 548 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 32 PID 572 wrote to memory of 2000 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 34 PID 572 wrote to memory of 2000 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 34 PID 572 wrote to memory of 2000 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 34 PID 572 wrote to memory of 2000 572 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 34 PID 548 wrote to memory of 928 548 cmd.exe 36 PID 548 wrote to memory of 928 548 cmd.exe 36 PID 548 wrote to memory of 928 548 cmd.exe 36 PID 548 wrote to memory of 928 548 cmd.exe 36 PID 2000 wrote to memory of 1744 2000 cmd.exe 37 PID 2000 wrote to memory of 1744 2000 cmd.exe 37 PID 2000 wrote to memory of 1744 2000 cmd.exe 37 PID 2000 wrote to memory of 1744 2000 cmd.exe 37 PID 2000 wrote to memory of 564 2000 cmd.exe 38 PID 2000 wrote to memory of 564 2000 cmd.exe 38 PID 2000 wrote to memory of 564 2000 cmd.exe 38 PID 2000 wrote to memory of 564 2000 cmd.exe 38 PID 564 wrote to memory of 960 564 nslookup.exe 39 PID 564 wrote to memory of 960 564 nslookup.exe 39 PID 564 wrote to memory of 960 564 nslookup.exe 39 PID 564 wrote to memory of 960 564 nslookup.exe 39 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe"C:\Users\Admin\AppData\Local\Temp\8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"'3⤵
- Creates scheduled task(s)
PID:928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1BCA.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1744
-
-
C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:564 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD52b51e9fd34777129b4e903f33c074642
SHA158be10870041c192c43765ae8600e0aee7d11101
SHA256eb76ffe3366d33ecb6a06f004138035782333d909d46c8158e6cbdf4816bc1d0
SHA512ab76eacd54ac01f21946b86088869fdcf0bb6c6d732fc49dd80a59f49e3e2dea5226dd59f4edba098aabbbda11b57b36982c2c38371cd56267a9a471a8dfa224
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD589ac079495743cbbfda0d932adee7bc1
SHA1c4aa6af3ee8a67cd3ed67d34faa9b8b34643f57b
SHA256a4faf8189747309aa8668cce25b3b857ce5f9182c49d01f46fa5f910a303a867
SHA5122458fd46bcf428cef4babc89c7c1451c5dccd23c282764e50a57f1046ba0f9bb00dc0fcdae4e129797bcfd90b31cf83d804c46c95c94b66a206082c142ae9b19
-
Filesize
440KB
MD5a3b4d25af01edf5fe34fd6e13a1381e6
SHA13a60499205fa92a581d3b6cb232fc8ed8d750088
SHA2568b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f
SHA512d9269e5c8bbf672ef32e8f74d61bdd3abaa991a74fb092ca5dc7f9a25b8bb7cd0dc09b59b823336edcc9b18d226b9b8e518ac2ca710e2c9bd8ce5452b9ccc5b0
-
Filesize
440KB
MD5a3b4d25af01edf5fe34fd6e13a1381e6
SHA13a60499205fa92a581d3b6cb232fc8ed8d750088
SHA2568b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f
SHA512d9269e5c8bbf672ef32e8f74d61bdd3abaa991a74fb092ca5dc7f9a25b8bb7cd0dc09b59b823336edcc9b18d226b9b8e518ac2ca710e2c9bd8ce5452b9ccc5b0
-
Filesize
440KB
MD5a3b4d25af01edf5fe34fd6e13a1381e6
SHA13a60499205fa92a581d3b6cb232fc8ed8d750088
SHA2568b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f
SHA512d9269e5c8bbf672ef32e8f74d61bdd3abaa991a74fb092ca5dc7f9a25b8bb7cd0dc09b59b823336edcc9b18d226b9b8e518ac2ca710e2c9bd8ce5452b9ccc5b0