Analysis
- max time kernel
40s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
15/04/2022, 00:48
General
- Target 01d3f98f13701b89b27719e4959b8e14e94176c8811c8d03ecb5706e0ef96046.exe
- Size 2.6MB
- Sample220415-a51qqaabf4
- SHA256 01d3f98f13701b89b27719e4959b8e14e94176c8811c8d03ecb5706e0ef96046
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01d3f98f13701b89b27719e4959b8e14e94176c8811c8d03ecb5706e0ef96046.exe"C:\Users\Admin\AppData\Local\Temp\01d3f98f13701b89b27719e4959b8e14e94176c8811c8d03ecb5706e0ef96046.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svhost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
svhost.exe
svhost.exe
memory/2688-155-0x0000000007AB0000-0x0000000007ABA000-memory.dmp
memory/2688-146-0x0000000005E40000-0x0000000005E62000-memory.dmp
memory/2688-151-0x000000006FA30000-0x000000006FA7C000-memory.dmp
memory/2688-158-0x0000000007D80000-0x0000000007D9A000-memory.dmp
memory/2688-157-0x0000000007C70000-0x0000000007C7E000-memory.dmp
memory/2688-150-0x0000000006D10000-0x0000000006D42000-memory.dmp
memory/2688-156-0x0000000007CC0000-0x0000000007D56000-memory.dmp
memory/2688-152-0x0000000006CF0000-0x0000000006D0E000-memory.dmp
memory/2688-154-0x0000000007A40000-0x0000000007A5A000-memory.dmp
memory/2688-143-0x0000000005170000-0x00000000051A6000-memory.dmp
memory/2688-144-0x00000000057E0000-0x0000000005E08000-memory.dmp
memory/2688-153-0x0000000008080000-0x00000000086FA000-memory.dmp
memory/2688-159-0x0000000007D60000-0x0000000007D68000-memory.dmp
memory/2688-147-0x0000000005EE0000-0x0000000005F46000-memory.dmp
memory/2688-148-0x0000000006640000-0x000000000665E000-memory.dmp
memory/2688-149-0x0000000001775000-0x0000000001777000-memory.dmp
memory/3508-130-0x0000000000C70000-0x0000000000D16000-memory.dmp
memory/3508-131-0x0000000005670000-0x000000000570C000-memory.dmp
memory/4148-138-0x0000000005500000-0x0000000005AA4000-memory.dmp
memory/4148-145-0x0000000004C53000-0x0000000004C55000-memory.dmp
memory/4148-142-0x0000000006580000-0x00000000065D0000-memory.dmp
memory/4148-141-0x00000000064E0000-0x00000000064EA000-memory.dmp
memory/4148-139-0x0000000005C20000-0x0000000005C86000-memory.dmp
memory/4148-137-0x0000000004EB0000-0x0000000004F42000-memory.dmp
memory/4148-136-0x0000000000340000-0x00000000003C6000-memory.dmp