Overview

overview

10

Static

static

62ba72c8e5...cc.exe

windows7_x64

10

62ba72c8e5...cc.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    83s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-04-2022 12:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe

  • Size

    1.0MB

  • MD5

    a5f465e80c730365bef7d2016a06b4e8

  • SHA1

    47556b655932468d093df342fbf37049b7baf55c

  • SHA256

    62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc

  • SHA512

    cc487ffee2dcacb9e93ef81020725ae672d36e7b5599c1e7e751c1cb09cace941509410014fba3721cfa2a4801f1c02ac0f297cf96b26fea739d9b4f8f11166f

Score
10/10
massloggercollectionspywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Fresh.2019$

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main Payload 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe
    "C:\Users\Admin\AppData\Local\Temp\62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:324
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CHYEwkdoyxEGqz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB4EE.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2004
    • C:\Users\Admin\AppData\Local\Temp\62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1564

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB4EE.tmp
    Filesize

    1KB

    MD5

    14552513d9c895e232788c78f3be9873

    SHA1

    eecf54dcc0e9847dbf7495854ac983b9e56523d2

    SHA256

    3adb870aaa8551c67f1c1e3dac10b98b05d0edeac5455702ab091559af771d0c

    SHA512

    34f89ff3d48d9550adb3f8352fcb61e26975d3026a23aff9146eb578270bfe30ac23f5a6b537d6cd373240844dc0d4288df824c00cf91a21655e5a44e2e28629

    Download Submit

  • memory/324-55-0x0000000000830000-0x000000000084C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/324-56-0x000000000AA10000-0x000000000AAE4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/324-54-0x0000000001030000-0x0000000001136000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1564-63-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1564-59-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1564-60-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1564-62-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1564-64-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1564-65-0x00000000004812EE-mapping.dmp

    Download

  • memory/1564-67-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1564-69-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1564-70-0x0000000000BC0000-0x0000000000BFE000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1564-71-0x00000000062C0000-0x0000000006350000-memory.dmp

    Filesize

    576KB

    Download

  • memory/1564-72-0x0000000000E65000-0x0000000000E76000-memory.dmp

    Filesize

    68KB

    Download

  • memory/2004-57-0x0000000000000000-mapping.dmp

    Download