Analysis
-
max time kernel
62s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 12:39
General
-
Target
62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe
-
Size
1.0MB
-
MD5
a5f465e80c730365bef7d2016a06b4e8
-
SHA1
47556b655932468d093df342fbf37049b7baf55c
-
SHA256
62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc
-
SHA512
cc487ffee2dcacb9e93ef81020725ae672d36e7b5599c1e7e751c1cb09cace941509410014fba3721cfa2a4801f1c02ac0f297cf96b26fea739d9b4f8f11166f
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
jokerhacks891@gmail.com - Password:
Fresh.2019$
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
-
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe"C:\Users\Admin\AppData\Local\Temp\62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CHYEwkdoyxEGqz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B73.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\62ba72c8e528303083fadcd97e95c3115bf1982e6d1516472dfd0c9abbf8e0cc.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
-
DNSapi.ipify.orgRemote address:8.8.8.8:53Requestapi.ipify.orgIN AResponseapi.ipify.orgIN CNAMEapi.ipify.org.herokudns.comapi.ipify.org.herokudns.comIN A3.220.57.224api.ipify.org.herokudns.comIN A3.232.242.170api.ipify.org.herokudns.comIN A54.91.59.199api.ipify.org.herokudns.comIN A52.20.78.240 -
GEThttp://api.ipify.org/Remote address:3.220.57.224:80RequestGET / HTTP/1.1
Host: api.ipify.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Server: Cowboy
Connection: keep-alive
Content-Type: text/plain
Vary: Origin
Date: Fri, 15 Apr 2022 12:43:04 GMT
Content-Length: 12
Via: 1.1 vegur
-
DNSsmtp.gmail.comRemote address:8.8.8.8:53Requestsmtp.gmail.comIN AResponsesmtp.gmail.comIN A142.250.102.109
-
52.168.117.170:443
-
3.220.57.224:80http://api.ipify.org/http
HTTP Request
GET http://api.ipify.org/HTTP Response
200 -
142.250.102.109:587smtp.gmail.comsmtp
-
93.184.221.240:80
-
93.184.221.240:80
-
8.8.8.8:53api.ipify.orgdns
DNS Request
api.ipify.org
DNS Response
3.220.57.2243.232.242.17054.91.59.19952.20.78.240
-
8.8.8.8:53smtp.gmail.comdns
DNS Request
smtp.gmail.com
DNS Response
142.250.102.109
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD550f3be11172956f1f43631440193e9db
SHA144be2d7b434a9875388e71a299b6a79420cff8d6
SHA2566422e9b259e22cc0ef6da1605954b5cace29e492636838e8889b30775ea58758
SHA5125234d1f42e79fe2185cd6ca3e32a7a31ca08c14938eb84c583802522be11a34b28152a88180d85b2be9b23dd5ac35dd3d34dfda96aa699dc67fc238449ff91e4
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
5.2MB
-
Filesize
624KB
-
Filesize
1.0MB
-
Filesize
536KB
-
Filesize
408KB
-
Filesize
8KB
-
Filesize
320KB