Analysis
- max time kernel
151s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/04/2022, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe
- Size 1.1MB
- Sample220420-e1257sfehj
- SHA256 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d
- MD5 0030b152a3b0a429ea3389f6b739c2a0
- SHA1 46452a95e92729737ec83db171ac45f68380678d
- SHA512 e57e7c31cba09c52c502fec24a5c21db34cd8471b471c6e6f50104bba5e25e0326cf4868bc63150ead362f9670405f25b557274b3bbd5df1e85a88c4980c74ea
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 2 IoCs
resource yara_rule behavioral2/memory/2756-140-0x0000000000980000-0x0000000000A06000-memory.dmp family_masslogger behavioral2/memory/2756-141-0x0000000000980000-0x0000000000A06000-memory.dmp family_masslogger - Executes dropped EXE 3 IoCs
pid Process 960 iuytbf.exe 2756 iuytbf.exe 1868 iuytbf.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation iuytbf.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ghg.vbs notepad.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook iuytbf.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook iuytbf.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook iuytbf.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook iuytbf.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook iuytbf.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 api.ipify.org 22 api.ipify.org - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 960 set thread context of 2756 960 iuytbf.exe 81 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ iuytbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ iuytbf.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ iuytbf.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe:ZoneIdentifier notepad.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2756 iuytbf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3664 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe 3664 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe 960 iuytbf.exe 960 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe 1868 iuytbf.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 960 iuytbf.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2756 iuytbf.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2756 iuytbf.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3664 wrote to memory of 1280 3664 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe 79 PID 3664 wrote to memory of 1280 3664 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe 79 PID 3664 wrote to memory of 1280 3664 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe 79 PID 3664 wrote to memory of 1280 3664 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe 79 PID 3664 wrote to memory of 1280 3664 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe 79 PID 1280 wrote to memory of 960 1280 notepad.exe 80 PID 1280 wrote to memory of 960 1280 notepad.exe 80 PID 1280 wrote to memory of 960 1280 notepad.exe 80 PID 960 wrote to memory of 2756 960 iuytbf.exe 81 PID 960 wrote to memory of 2756 960 iuytbf.exe 81 PID 960 wrote to memory of 2756 960 iuytbf.exe 81 PID 960 wrote to memory of 1868 960 iuytbf.exe 82 PID 960 wrote to memory of 1868 960 iuytbf.exe 82 PID 960 wrote to memory of 1868 960 iuytbf.exe 82 - outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe - outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 iuytbf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe"C:\Users\Admin\AppData\Local\Temp\354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe"C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe"C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2756
-
-
C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe"C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe" 2 2756 2405510784⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1868
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe
- Size 1.1MB
- SHA256 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d
- MD5 0030b152a3b0a429ea3389f6b739c2a0
- SHA1 46452a95e92729737ec83db171ac45f68380678d
- SHA512 e57e7c31cba09c52c502fec24a5c21db34cd8471b471c6e6f50104bba5e25e0326cf4868bc63150ead362f9670405f25b557274b3bbd5df1e85a88c4980c74ea
- SSDEEP 24576:kcCNXYgskVP0Ty8r4UgWPCC2pdXgHT7Nx5j1nAA:kJBcW0HrgEB2pKp1nAA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe
- Size 1.1MB
- SHA256 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d
- MD5 0030b152a3b0a429ea3389f6b739c2a0
- SHA1 46452a95e92729737ec83db171ac45f68380678d
- SHA512 e57e7c31cba09c52c502fec24a5c21db34cd8471b471c6e6f50104bba5e25e0326cf4868bc63150ead362f9670405f25b557274b3bbd5df1e85a88c4980c74ea
- SSDEEP 24576:kcCNXYgskVP0Ty8r4UgWPCC2pdXgHT7Nx5j1nAA:kJBcW0HrgEB2pKp1nAA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe
- Size 1.1MB
- SHA256 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d
- MD5 0030b152a3b0a429ea3389f6b739c2a0
- SHA1 46452a95e92729737ec83db171ac45f68380678d
- SHA512 e57e7c31cba09c52c502fec24a5c21db34cd8471b471c6e6f50104bba5e25e0326cf4868bc63150ead362f9670405f25b557274b3bbd5df1e85a88c4980c74ea
- SSDEEP 24576:kcCNXYgskVP0Ty8r4UgWPCC2pdXgHT7Nx5j1nAA:kJBcW0HrgEB2pKp1nAA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\AppData\iuytbf.exe
- Size 1.1MB
- SHA256 354852369f73c1ea5373b80d41dcea51da050314e4166f6db31d77708181630d
- MD5 0030b152a3b0a429ea3389f6b739c2a0
- SHA1 46452a95e92729737ec83db171ac45f68380678d
- SHA512 e57e7c31cba09c52c502fec24a5c21db34cd8471b471c6e6f50104bba5e25e0326cf4868bc63150ead362f9670405f25b557274b3bbd5df1e85a88c4980c74ea
- SSDEEP 24576:kcCNXYgskVP0Ty8r4UgWPCC2pdXgHT7Nx5j1nAA:kJBcW0HrgEB2pKp1nAA
- MD5 SHA1 SHA512 SSDEEP