Analysis

  • max time kernel
    137s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    14-04-2022 13:33

General

  • Target

    ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe

  • Size

    1.2MB

  • MD5

    d41f9a1ae3f045597195a62151d9fa1e

  • SHA1

    0be09858db0cbf90d88e606595c4b2c1a895ad9b

  • SHA256

    ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08

  • SHA512

    6149078f06498ffa254a6703015e4bd893f3c77043b58d6b69532f029f42e0287690d197b8b870ffe9972185e7d3c45dcd6a5e6ed90f46b170cdad75648cbf68

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe
    "C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe
      "C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe"
      2⤵
        PID:2188
      • C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe
        "C:\Users\Admin\AppData\Local\Temp\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe"
        2⤵
        • Checks computer location settings
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:1996

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ebdae4060d9881f18fe136472d93bfa71c89fcf9dfc0cfa7c70c0ab805522e08.exe.log

      Filesize

      226B

      MD5

      916851e072fbabc4796d8916c5131092

      SHA1

      d48a602229a690c512d5fdaf4c8d77547a88e7a2

      SHA256

      7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

      SHA512

      07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

    • memory/1996-136-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

    • memory/1996-138-0x0000000005BF0000-0x0000000005C82000-memory.dmp

      Filesize

      584KB

    • memory/1996-139-0x0000000006240000-0x00000000067E4000-memory.dmp

      Filesize

      5.6MB

    • memory/1996-140-0x0000000006AE0000-0x0000000006B46000-memory.dmp

      Filesize

      408KB

    • memory/1996-141-0x0000000007320000-0x0000000007370000-memory.dmp

      Filesize

      320KB

    • memory/1996-142-0x00000000072F0000-0x00000000072FA000-memory.dmp

      Filesize

      40KB

    • memory/1996-143-0x0000000007540000-0x00000000075DC000-memory.dmp

      Filesize

      624KB

    • memory/1996-144-0x0000000005763000-0x0000000005765000-memory.dmp

      Filesize

      8KB

    • memory/4028-133-0x0000000000320000-0x0000000000450000-memory.dmp

      Filesize

      1.2MB