Analysis

  • max time kernel
    141s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    17-04-2022 07:50

General

  • Target

    874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe

  • Size

    1.1MB

  • MD5

    5129c4871c5c6e7f6233e9fe21346a6b

  • SHA1

    c81cce9a933a5c6ca3eb458f3d1a0c04a792d117

  • SHA256

    874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e

  • SHA512

    a0c702d8814707e05212fa09942140bee5833680842489157e05d54cdd39af7b385e585b984c0ea4978aefdd88b46b15ee26afa3e74e1184fb9f0d7866383d4a

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
    "C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
      "C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"
      2⤵
        PID:2000
      • C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
        "C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"
        2⤵
          PID:4268
        • C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
          "C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"
          2⤵
            PID:4188
          • C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
            "C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"
            2⤵
            • Checks computer location settings
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • outlook_office_path
            • outlook_win_path
            PID:4384
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe'
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3768

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2000-136-0x0000000000000000-mapping.dmp

        • memory/2260-130-0x0000000000720000-0x0000000000836000-memory.dmp

          Filesize

          1.1MB

        • memory/2260-131-0x0000000005190000-0x000000000522C000-memory.dmp

          Filesize

          624KB

        • memory/2260-132-0x00000000057E0000-0x0000000005D84000-memory.dmp

          Filesize

          5.6MB

        • memory/2260-133-0x00000000052D0000-0x0000000005362000-memory.dmp

          Filesize

          584KB

        • memory/2260-135-0x0000000005500000-0x0000000005556000-memory.dmp

          Filesize

          344KB

        • memory/2260-134-0x0000000005280000-0x000000000528A000-memory.dmp

          Filesize

          40KB

        • memory/3768-151-0x0000000006E80000-0x0000000006EB2000-memory.dmp

          Filesize

          200KB

        • memory/3768-153-0x0000000006470000-0x000000000648E000-memory.dmp

          Filesize

          120KB

        • memory/3768-160-0x00000000074F0000-0x00000000074F8000-memory.dmp

          Filesize

          32KB

        • memory/3768-159-0x0000000007510000-0x000000000752A000-memory.dmp

          Filesize

          104KB

        • memory/3768-158-0x0000000005DA0000-0x0000000005DAE000-memory.dmp

          Filesize

          56KB

        • memory/3768-142-0x0000000000000000-mapping.dmp

        • memory/3768-157-0x0000000007450000-0x00000000074E6000-memory.dmp

          Filesize

          600KB

        • memory/3768-144-0x00000000025C0000-0x00000000025F6000-memory.dmp

          Filesize

          216KB

        • memory/3768-156-0x0000000007230000-0x000000000723A000-memory.dmp

          Filesize

          40KB

        • memory/3768-146-0x00000000050D0000-0x00000000056F8000-memory.dmp

          Filesize

          6.2MB

        • memory/3768-147-0x0000000005730000-0x0000000005752000-memory.dmp

          Filesize

          136KB

        • memory/3768-148-0x00000000057D0000-0x0000000005836000-memory.dmp

          Filesize

          408KB

        • memory/3768-149-0x0000000005890000-0x00000000058AE000-memory.dmp

          Filesize

          120KB

        • memory/3768-150-0x00000000026F5000-0x00000000026F7000-memory.dmp

          Filesize

          8KB

        • memory/3768-155-0x00000000071C0000-0x00000000071DA000-memory.dmp

          Filesize

          104KB

        • memory/3768-152-0x000000006FE60000-0x000000006FEAC000-memory.dmp

          Filesize

          304KB

        • memory/3768-154-0x0000000007810000-0x0000000007E8A000-memory.dmp

          Filesize

          6.5MB

        • memory/4188-138-0x0000000000000000-mapping.dmp

        • memory/4268-137-0x0000000000000000-mapping.dmp

        • memory/4384-145-0x0000000005113000-0x0000000005115000-memory.dmp

          Filesize

          8KB

        • memory/4384-143-0x0000000006F30000-0x0000000006F80000-memory.dmp

          Filesize

          320KB

        • memory/4384-141-0x00000000065A0000-0x0000000006606000-memory.dmp

          Filesize

          408KB

        • memory/4384-140-0x0000000000400000-0x0000000000486000-memory.dmp

          Filesize

          536KB

        • memory/4384-139-0x0000000000000000-mapping.dmp