Analysis
-
max time kernel
107s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-04-2022 02:16
General
-
Target
239f15b4cd5a3be1b71da1cf09d67d1560569a4272838948141b79967367157e.exe
-
Size
1.4MB
-
MD5
d37c977afd1ae6aa6e0b004322adb33c
-
SHA1
5360e8f454b9b4368bcf930725dc16640533a65d
-
SHA256
239f15b4cd5a3be1b71da1cf09d67d1560569a4272838948141b79967367157e
-
SHA512
e5f78b9e620e2e0869a7ae62fa4fd1e9bee2e880a7c85c49e4581b8cd903f688e34505025d7cd584325ef2aba1c448ce0334a44d0df60a9e971b6f52986d1fb8
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\239f15b4cd5a3be1b71da1cf09d67d1560569a4272838948141b79967367157e.exe"C:\Users\Admin\AppData\Local\Temp\239f15b4cd5a3be1b71da1cf09d67d1560569a4272838948141b79967367157e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bogeIdjHjdIw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5810.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\239f15b4cd5a3be1b71da1cf09d67d1560569a4272838948141b79967367157e.exe"C:\Users\Admin\AppData\Local\Temp\239f15b4cd5a3be1b71da1cf09d67d1560569a4272838948141b79967367157e.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\239f15b4cd5a3be1b71da1cf09d67d1560569a4272838948141b79967367157e.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50575e187ae824a38e19ee5d0357e3f80
SHA147371b9cdad2e0536ec0f67f4e880759d5609a94
SHA25657957cb86bb7f1b91e0b954445716b08e4c45ba470b1d4a4d4d3539a329f2c79
SHA512a48715c9b20b610bd5f385c6dcf150bfb1e322b75fe2940bd26b9dcc0012c1d3588ea189e26d2508a10cbb2d0f50c5d3c162b9b0dfb1b3e8b9fb6ea95b4c1f0b
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
768KB
-
Filesize
544KB
-
Filesize
5.7MB
-
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
68KB
-