Malware Analysis Report

2025-01-18 04:59

Sample ID 220330-c75hssehh5
Target e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4
SHA256 e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4
Tags
masslogger collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4

Threat Level: Known bad

The file e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4 was found to be: Known bad.

Malicious Activity Summary

masslogger collection spyware stealer

MassLogger

MassLogger Main Payload

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-30 02:44

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-03-30 02:44

Reported

2022-04-01 09:36

Platform

win10v2004-20220331-en

Max time kernel

68s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe"

Signatures

MassLogger

stealer spyware masslogger

MassLogger Main Payload

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2868 set thread context of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2868 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 2868 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 2868 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 2868 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 2868 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 2868 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 2868 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 2868 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

outlook_office_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

outlook_win_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe

"C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe"

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"

Network

Country Destination Domain Proto
US 20.189.173.9:443 tcp
FI 62.115.252.81:80 tcp
FI 62.115.252.81:80 tcp
FI 62.115.252.81:80 tcp
US 8.8.8.8:53 api.ipify.org udp
US 54.91.59.199:80 api.ipify.org tcp

Files

memory/2868-124-0x00000000007F0000-0x00000000008C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll

MD5 14ff402962ad21b78ae0b4c43cd1f194
SHA1 f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256 fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512 daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

memory/2868-126-0x0000000073000000-0x0000000073089000-memory.dmp

memory/2868-127-0x0000000005DA0000-0x0000000006344000-memory.dmp

memory/2868-128-0x0000000005890000-0x0000000005922000-memory.dmp

memory/3244-129-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

memory/3244-133-0x0000000000600000-0x0000000000686000-memory.dmp

memory/3244-134-0x0000000005BD0000-0x0000000005C36000-memory.dmp

memory/3244-135-0x0000000006280000-0x00000000062D0000-memory.dmp

memory/3244-136-0x0000000006510000-0x00000000065AC000-memory.dmp

memory/3244-137-0x00000000063E0000-0x00000000063EA000-memory.dmp

memory/3244-138-0x0000000004A83000-0x0000000004A85000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-03-30 02:44

Reported

2022-04-01 09:42

Platform

win7-20220331-en

Max time kernel

65s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe"

Signatures

MassLogger

stealer spyware masslogger

MassLogger Main Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1400 set thread context of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
PID 1400 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

outlook_office_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

outlook_win_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\RegAsm.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe

"C:\Users\Admin\AppData\Local\Temp\e4ef7fd36fe35a933c6ac97a274a0598a78cfb4f5144525c0ad25d5b55f1a3a4.exe"

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 3.220.57.224:80 api.ipify.org tcp

Files

memory/1400-54-0x0000000000CE0000-0x0000000000DB0000-memory.dmp

memory/1400-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

memory/1400-56-0x00000000004B0000-0x00000000004D6000-memory.dmp

\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll

MD5 14ff402962ad21b78ae0b4c43cd1f194
SHA1 f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256 fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512 daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

memory/1400-59-0x00000000005A0000-0x00000000005AC000-memory.dmp

\Users\Admin\AppData\Local\Temp\RegAsm.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

memory/2012-61-0x0000000000400000-0x0000000000486000-memory.dmp

memory/2012-62-0x0000000000400000-0x0000000000486000-memory.dmp

memory/2012-64-0x0000000000400000-0x0000000000486000-memory.dmp

memory/2012-65-0x0000000000400000-0x0000000000486000-memory.dmp

memory/2012-66-0x0000000000400000-0x0000000000486000-memory.dmp

memory/2012-67-0x00000000004819FE-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

memory/2012-70-0x0000000000400000-0x0000000000486000-memory.dmp

memory/2012-72-0x0000000000400000-0x0000000000486000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

\Users\Admin\AppData\Local\Temp\RegAsm.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

memory/2012-76-0x0000000004F95000-0x0000000004FA6000-memory.dmp