Analysis

  • max time kernel
    85s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220331-en
  • submitted
    14-04-2022 13:33

General

  • Target

    ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe

  • Size

    1.2MB

  • MD5

    d41f9a1ae3f045597195a62151d9fa1e

  • SHA1

    0be09858db0cbf90d88e606595c4b2c1a895ad9b

  • SHA256

    ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08

  • SHA512

    6149078f06498ffa254a6703015e4bd893f3c77043b58d6b69532f029f42e0287690d197b8b870ffe9972185e7d3c45dcd6a5e6ed90f46b170cdad75648cbf68

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe
    "C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe
      "C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:2028

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1884-54-0x0000000000900000-0x0000000000A30000-memory.dmp

    Filesize

    1.2MB

  • memory/1884-55-0x0000000004980000-0x0000000004A18000-memory.dmp

    Filesize

    608KB

  • memory/1884-56-0x0000000000860000-0x000000000087C000-memory.dmp

    Filesize

    112KB

  • memory/2028-57-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2028-58-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2028-60-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2028-61-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2028-62-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2028-65-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2028-67-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2028-68-0x0000000000365000-0x0000000000376000-memory.dmp

    Filesize

    68KB