Analysis
-
max time kernel
4294180s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
28-03-2022 20:50
Static task
static1
Behavioral task
behavioral1
Sample
5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe
Resource
win10v2004-en-20220113
General
-
Target
5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe
-
Size
1.0MB
-
MD5
8120df9b2ed51328ce8df5a6ab4d498a
-
SHA1
1b312069c24d2ceb384b8bed9c4a58fb932c89b2
-
SHA256
5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc
-
SHA512
44bcd103fed8c7e0b55a0c82563a974845b828c2ec23f629298b466c012dcd05b6c03cab0adf884eadb4241997b805a490836daff86097230d755c32bcbabd61
Malware Config
Extracted
Protocol: smtp- Host:
mail.paminakids.com - Port:
587 - Username:
[email protected] - Password:
nRBy874S437
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
resource yara_rule behavioral1/memory/1944-64-0x0000000000520000-0x00000000005A6000-memory.dmp family_masslogger behavioral1/memory/1944-63-0x0000000000520000-0x00000000005A6000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International\Geo\Nation 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe -
Deletes itself 1 IoCs
pid Process 1688 powershell.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBBBBBBBB.vbs notepad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1752 set thread context of 1944 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 28 -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 1564 powershell.exe 1688 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe Token: SeDebugPrivilege 1564 powershell.exe Token: SeDebugPrivilege 1688 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1752 wrote to memory of 580 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 27 PID 1752 wrote to memory of 580 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 27 PID 1752 wrote to memory of 580 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 27 PID 1752 wrote to memory of 580 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 27 PID 1752 wrote to memory of 580 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 27 PID 1752 wrote to memory of 580 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 27 PID 1752 wrote to memory of 1944 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 28 PID 1752 wrote to memory of 1944 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 28 PID 1752 wrote to memory of 1944 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 28 PID 1752 wrote to memory of 1944 1752 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 28 PID 1944 wrote to memory of 1564 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 30 PID 1944 wrote to memory of 1564 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 30 PID 1944 wrote to memory of 1564 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 30 PID 1944 wrote to memory of 1564 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 30 PID 1944 wrote to memory of 1688 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 32 PID 1944 wrote to memory of 1688 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 32 PID 1944 wrote to memory of 1688 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 32 PID 1944 wrote to memory of 1688 1944 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe 32 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe"C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:580
-
-
C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe"C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1944 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\5f8a84bc4ecfc9e800e1d5e1c2bfa79acfa9548983769b70289d9b19943cb4bc.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD537ec93163e86fd60024c3b7752d00cfc
SHA12322a736ac0b7efcc015a82f5e9553f8bdfc6f53
SHA256d60baa63637c7c849c37164f2bc863952c0f9dd5cd33a07e9ff511d9d1f043e1
SHA512939b341f6cff442e70a363e5e40a375d6da7b3b92694c10883b5f453c7232196e2143c5d7d15d4e84c7b7e3b66d9b9307346a0741c1deb5715f1b2b8392c5af2