Analysis
-
max time kernel
4294178s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
26-03-2022 15:02
Static task
static1
Behavioral task
behavioral1
Sample
3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
Resource
win10v2004-en-20220113
General
-
Target
3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
-
Size
821KB
-
MD5
b0c6c62c19099f962f6a8c942051c33d
-
SHA1
0985c98469e35361d235df11417b0bf9ead7f110
-
SHA256
3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e
-
SHA512
bc9710bf121a9c4887a317931e60b57f73497bd836e918e1765812bedbc312af611e8c298860b44bce2ecc3a3776725b0be4cb4091382d74d41e94930897e735
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
resource yara_rule behavioral1/memory/1216-60-0x00000000043F0000-0x000000000447C000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International\Geo\Nation 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe -
Deletes itself 1 IoCs
pid Process 1540 powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1220 set thread context of 1216 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 29 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2032 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 1580 powershell.exe 1540 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Token: SeDebugPrivilege 1580 powershell.exe Token: SeDebugPrivilege 1540 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1220 wrote to memory of 1668 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 28 PID 1220 wrote to memory of 1668 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 28 PID 1220 wrote to memory of 1668 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 28 PID 1220 wrote to memory of 1668 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 28 PID 1220 wrote to memory of 1216 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 29 PID 1220 wrote to memory of 1216 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 29 PID 1220 wrote to memory of 1216 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 29 PID 1220 wrote to memory of 1216 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 29 PID 1220 wrote to memory of 1216 1220 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 29 PID 1668 wrote to memory of 2032 1668 cmd.exe 30 PID 1668 wrote to memory of 2032 1668 cmd.exe 30 PID 1668 wrote to memory of 2032 1668 cmd.exe 30 PID 1668 wrote to memory of 2032 1668 cmd.exe 30 PID 1216 wrote to memory of 1580 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 32 PID 1216 wrote to memory of 1580 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 32 PID 1216 wrote to memory of 1580 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 32 PID 1216 wrote to memory of 1580 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 32 PID 1216 wrote to memory of 1540 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 34 PID 1216 wrote to memory of 1540 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 34 PID 1216 wrote to memory of 1540 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 34 PID 1216 wrote to memory of 1540 1216 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 34 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\9d77f4a40ffa452f8c1e2fdd2b545943.xml"2⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\9d77f4a40ffa452f8c1e2fdd2b545943.xml"3⤵
- Creates scheduled task(s)
PID:2032
-
-
-
C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1216 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5de0568b191c83304806f799becda4ebb
SHA1fa173d7dbcfbff032aed5c0c78f2e77758acfbac
SHA2565a76e8ae2a68014deae6999886f074625e6397692d1578697c76e47a2ba2f442
SHA5121190c6ec33d231d18f52cad4e5ed234f8670fad22acb05292c5cd9dc9a96d3f7cbc6d6dbdca8bf18f9852aff3b0c1a04721f82d7f43133ae66f8c8680f80eb5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD53a3320d6fd7c6fef48ec232f933b3247
SHA14b5550ed6dcd9a499534df2c2f2c1e5f575f7774
SHA256b04d000316bd1e4c740aa7974e4bff33956e5c7f29d9a0e8dc889b6356efce70
SHA512ec839971d6431f2f07f576637d4fb653343e73254bb9a931e7cbad97fa6010a77b8e045b5eb9c952e4a2a2b9761e5f214324eac4b156fd011e151aa890ecb77a