Analysis

  • max time kernel
    4294194s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    26-03-2022 14:01

General

  • Target

    56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe

  • Size

    1.1MB

  • MD5

    6830019535eeca9c9fb9a28349c71ab8

  • SHA1

    d256790b9bf99acdc5fe3fe97dda339a7ff6e502

  • SHA256

    56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9

  • SHA512

    037e965770681b5a89577b72d2ebbeac1bd6b84ca98576228676dd328bbaa80262544532355db101be29fb8a6ef88a632180323d68973057f282e94e8182589d

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 7 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe
    "C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe
      "C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe"
      2⤵
        PID:1884
      • C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe
        "C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe"
        2⤵
          PID:1888
        • C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe
          "C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe"
          2⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9.exe'
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1492
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn src.exe /tr '"C:\Users\Admin\AppData\Local\Temp\sre\src.exe"' & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1048
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn src.exe /tr '"C:\Users\Admin\AppData\Local\Temp\sre\src.exe"'
              4⤵
              • Creates scheduled task(s)
              PID:2012
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4A78.tmp.bat""
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1344
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              4⤵
              • Delays execution with timeout.exe
              PID:1716
            • C:\Users\Admin\AppData\Local\Temp\sre\src.exe
              "C:\Users\Admin\AppData\Local\Temp\sre\src.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1672
              • C:\Users\Admin\AppData\Local\Temp\sre\src.exe
                "C:\Users\Admin\AppData\Local\Temp\sre\src.exe"
                5⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Accesses Microsoft Outlook profiles
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • outlook_office_path
                • outlook_win_path
                PID:108
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sre\src.exe'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1556

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\sre\src.exe

        Filesize

        1.1MB

        MD5

        6830019535eeca9c9fb9a28349c71ab8

        SHA1

        d256790b9bf99acdc5fe3fe97dda339a7ff6e502

        SHA256

        56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9

        SHA512

        037e965770681b5a89577b72d2ebbeac1bd6b84ca98576228676dd328bbaa80262544532355db101be29fb8a6ef88a632180323d68973057f282e94e8182589d

      • C:\Users\Admin\AppData\Local\Temp\sre\src.exe

        Filesize

        1.1MB

        MD5

        6830019535eeca9c9fb9a28349c71ab8

        SHA1

        d256790b9bf99acdc5fe3fe97dda339a7ff6e502

        SHA256

        56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9

        SHA512

        037e965770681b5a89577b72d2ebbeac1bd6b84ca98576228676dd328bbaa80262544532355db101be29fb8a6ef88a632180323d68973057f282e94e8182589d

      • C:\Users\Admin\AppData\Local\Temp\sre\src.exe

        Filesize

        1.1MB

        MD5

        6830019535eeca9c9fb9a28349c71ab8

        SHA1

        d256790b9bf99acdc5fe3fe97dda339a7ff6e502

        SHA256

        56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9

        SHA512

        037e965770681b5a89577b72d2ebbeac1bd6b84ca98576228676dd328bbaa80262544532355db101be29fb8a6ef88a632180323d68973057f282e94e8182589d

      • C:\Users\Admin\AppData\Local\Temp\tmp4A78.tmp.bat

        Filesize

        154B

        MD5

        407ac321db76477ad8b09c6fd85a146d

        SHA1

        7fa6e437b1c7a7dae03d40fbfa7814f464459fdc

        SHA256

        8bc3b29ee6b2d533cc7ff3390787727c4155c944b18a0db8ea9bbf85d5c10c51

        SHA512

        88e7c71ffe4fe8cb705e9017bfb111f8783bab81faf083f42715ea158b3aae18ee45a4f01c4b393736d93a391476a8afe9eb4950dc4b71d5cef9f3e1d44c5c6c

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        Filesize

        7KB

        MD5

        a4420c17d9dd2554657753384769d988

        SHA1

        0a7da382023d634c0828f8d27f1e914faeb608f9

        SHA256

        dd43dc176817b09f2a1b9cdccc063edaab6735b448e0f331f64fc01c7a76172e

        SHA512

        2bb48da2de645003350318e4d25b15b6b74550609e31ca5b6edfe383aadd4713e4299ea96210202501504f027062ff255390598da2bf6523a325e924c032a7fe

      • \Users\Admin\AppData\Local\Temp\sre\src.exe

        Filesize

        1.1MB

        MD5

        6830019535eeca9c9fb9a28349c71ab8

        SHA1

        d256790b9bf99acdc5fe3fe97dda339a7ff6e502

        SHA256

        56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9

        SHA512

        037e965770681b5a89577b72d2ebbeac1bd6b84ca98576228676dd328bbaa80262544532355db101be29fb8a6ef88a632180323d68973057f282e94e8182589d

      • \Users\Admin\AppData\Local\Temp\sre\src.exe

        Filesize

        1.1MB

        MD5

        6830019535eeca9c9fb9a28349c71ab8

        SHA1

        d256790b9bf99acdc5fe3fe97dda339a7ff6e502

        SHA256

        56057644240d78cbf74272e6ff8964e501cc76d7e4d803e0749f0f02bc538af9

        SHA512

        037e965770681b5a89577b72d2ebbeac1bd6b84ca98576228676dd328bbaa80262544532355db101be29fb8a6ef88a632180323d68973057f282e94e8182589d

      • memory/108-102-0x0000000004BB5000-0x0000000004BC6000-memory.dmp

        Filesize

        68KB

      • memory/1248-63-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

      • memory/1248-67-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

      • memory/1248-69-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

      • memory/1248-64-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

      • memory/1248-62-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

      • memory/1248-60-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

      • memory/1248-74-0x0000000004CA5000-0x0000000004CB6000-memory.dmp

        Filesize

        68KB

      • memory/1248-59-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

      • memory/1492-83-0x0000000074320000-0x00000000748CB000-memory.dmp

        Filesize

        5.7MB

      • memory/1492-71-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

        Filesize

        8KB

      • memory/1492-84-0x0000000002490000-0x00000000030DA000-memory.dmp

        Filesize

        12.3MB

      • memory/1556-101-0x000000006EB50000-0x000000006F0FB000-memory.dmp

        Filesize

        5.7MB

      • memory/1608-57-0x00000000008C0000-0x00000000008CA000-memory.dmp

        Filesize

        40KB

      • memory/1608-58-0x0000000005550000-0x00000000055D8000-memory.dmp

        Filesize

        544KB

      • memory/1608-56-0x0000000005290000-0x0000000005350000-memory.dmp

        Filesize

        768KB

      • memory/1608-54-0x0000000000190000-0x00000000002A4000-memory.dmp

        Filesize

        1.1MB

      • memory/1608-55-0x00000000004B0000-0x00000000004CC000-memory.dmp

        Filesize

        112KB

      • memory/1672-82-0x0000000001300000-0x0000000001414000-memory.dmp

        Filesize

        1.1MB