Analysis
-
max time kernel
4294181s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
28-03-2022 22:22
Static task
static1
Behavioral task
behavioral1
Sample
0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe
Resource
win10v2004-en-20220113
General
-
Target
0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe
-
Size
1.8MB
-
MD5
74af9467eb836f933d28abaf4710a4b7
-
SHA1
dba84ce4920d9d149a8ef040905c273bb753e17a
-
SHA256
0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689
-
SHA512
2e3d7d06393443925e5d4dee7edf9ab851f93703cbc22c7fc2e6c5cff1b164a6f2efcec5d544480fb7a3b3bfcd524cf513f8a97a5c4ee79fc4fcddddbb0bac78
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
resource yara_rule behavioral1/memory/1488-57-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 580 set thread context of 1488 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 27 -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1488 MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1488 MSBuild.exe 1488 MSBuild.exe 1488 MSBuild.exe 1488 MSBuild.exe 1696 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1488 MSBuild.exe Token: SeDebugPrivilege 1696 powershell.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1488 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 580 wrote to memory of 1488 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 27 PID 580 wrote to memory of 1488 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 27 PID 580 wrote to memory of 1488 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 27 PID 580 wrote to memory of 1488 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 27 PID 580 wrote to memory of 1488 580 0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe 27 PID 1488 wrote to memory of 1696 1488 MSBuild.exe 29 PID 1488 wrote to memory of 1696 1488 MSBuild.exe 29 PID 1488 wrote to memory of 1696 1488 MSBuild.exe 29 PID 1488 wrote to memory of 1696 1488 MSBuild.exe 29 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe"C:\Users\Admin\AppData\Local\Temp\0cd32defaaa5d1d14d19f9317df3ab366951a2544185fc68132fd4c6bf8ea689.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1488 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-