Analysis
-
max time kernel
4294181s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
26-03-2022 16:54
Static task
static1
Behavioral task
behavioral1
Sample
63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe
Resource
win10v2004-en-20220113
General
-
Target
63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe
-
Size
411KB
-
MD5
4bf2b285e0392f1be1e357503cead553
-
SHA1
0c3e961e3cb3ab244211a82a24c3d4a6d5713e1b
-
SHA256
63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2
-
SHA512
4547de80c187a3355a533d84dfabd0ca205fb73c915f2a0913ff3d2e644debefced5ed6c001ba3b7711c76a58bf9bd2707ca62d51c1cbd41dbe6333360f1c8c1
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
resource yara_rule behavioral1/memory/1648-56-0x0000000007FB0000-0x0000000008036000-memory.dmp family_masslogger -
Executes dropped EXE 1 IoCs
pid Process 1060 nslookup.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International\Geo\Nation nslookup.exe Key value queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International\Geo\Nation 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe -
Loads dropped DLL 1 IoCs
pid Process 1760 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org 10 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1552 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1480 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1060 nslookup.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 1936 powershell.exe 1060 nslookup.exe 1060 nslookup.exe 1060 nslookup.exe 1060 nslookup.exe 1060 nslookup.exe 1060 nslookup.exe 1112 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe Token: SeDebugPrivilege 1936 powershell.exe Token: SeDebugPrivilege 1060 nslookup.exe Token: SeDebugPrivilege 1112 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1060 nslookup.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1936 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 28 PID 1648 wrote to memory of 1936 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 28 PID 1648 wrote to memory of 1936 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 28 PID 1648 wrote to memory of 1936 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 28 PID 1648 wrote to memory of 1996 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 30 PID 1648 wrote to memory of 1996 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 30 PID 1648 wrote to memory of 1996 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 30 PID 1648 wrote to memory of 1996 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 30 PID 1648 wrote to memory of 1760 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 32 PID 1648 wrote to memory of 1760 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 32 PID 1648 wrote to memory of 1760 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 32 PID 1648 wrote to memory of 1760 1648 63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe 32 PID 1996 wrote to memory of 1552 1996 cmd.exe 34 PID 1996 wrote to memory of 1552 1996 cmd.exe 34 PID 1996 wrote to memory of 1552 1996 cmd.exe 34 PID 1996 wrote to memory of 1552 1996 cmd.exe 34 PID 1760 wrote to memory of 1480 1760 cmd.exe 35 PID 1760 wrote to memory of 1480 1760 cmd.exe 35 PID 1760 wrote to memory of 1480 1760 cmd.exe 35 PID 1760 wrote to memory of 1480 1760 cmd.exe 35 PID 1760 wrote to memory of 1060 1760 cmd.exe 36 PID 1760 wrote to memory of 1060 1760 cmd.exe 36 PID 1760 wrote to memory of 1060 1760 cmd.exe 36 PID 1760 wrote to memory of 1060 1760 cmd.exe 36 PID 1060 wrote to memory of 1112 1060 nslookup.exe 39 PID 1060 wrote to memory of 1112 1060 nslookup.exe 39 PID 1060 wrote to memory of 1112 1060 nslookup.exe 39 PID 1060 wrote to memory of 1112 1060 nslookup.exe 39 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe"C:\Users\Admin\AppData\Local\Temp\63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\63c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"'3⤵
- Creates scheduled task(s)
PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8749.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1480
-
-
C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5bc060de594b60e3694d589dbbaba5ce1
SHA145a3cb668e1e72c07ad0542500f794d91f2854a0
SHA25604455e07d89d1e9827a40d288b90147d641dffae565022f3434d5f2f71fcd203
SHA512dcb786cdc431a402d827c118418efb63f2719a73022602c8a6603f89fe12ced67776e78e82576acf59bc8a889c62c498b50fe6e4e3a8e736249939aa97acc1f3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD59fff146fd42b655737f7f42eb5873b28
SHA175621a484f64a237b3246558cc5ad0efc320ee46
SHA2567bf68ae2ccf795bd6ea3dcd25cf7f610e702b3cc1005a443251e198d27893d84
SHA512f3a96f9845b832c2f624009ae57f07a8bdd002f6fe49aeb82f7a73f625ce140d67d8bb92509f8d0857636624fb26604a10d39843f5caa149ee1c37f938b3db42
-
Filesize
411KB
MD54bf2b285e0392f1be1e357503cead553
SHA10c3e961e3cb3ab244211a82a24c3d4a6d5713e1b
SHA25663c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2
SHA5124547de80c187a3355a533d84dfabd0ca205fb73c915f2a0913ff3d2e644debefced5ed6c001ba3b7711c76a58bf9bd2707ca62d51c1cbd41dbe6333360f1c8c1
-
Filesize
411KB
MD54bf2b285e0392f1be1e357503cead553
SHA10c3e961e3cb3ab244211a82a24c3d4a6d5713e1b
SHA25663c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2
SHA5124547de80c187a3355a533d84dfabd0ca205fb73c915f2a0913ff3d2e644debefced5ed6c001ba3b7711c76a58bf9bd2707ca62d51c1cbd41dbe6333360f1c8c1
-
Filesize
411KB
MD54bf2b285e0392f1be1e357503cead553
SHA10c3e961e3cb3ab244211a82a24c3d4a6d5713e1b
SHA25663c8f95c4f3a0e075e95be7cbae84a946c01515655ca894a4e87d07aaee928e2
SHA5124547de80c187a3355a533d84dfabd0ca205fb73c915f2a0913ff3d2e644debefced5ed6c001ba3b7711c76a58bf9bd2707ca62d51c1cbd41dbe6333360f1c8c1