Overview

overview

10

Static

static

68eef92865...49.exe

windows7_x64

10

68eef92865...49.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    131s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-04-2022 05:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe

  • Size

    1.2MB

  • MD5

    25700d5ea910882c8a64fa06b7a28bf5

  • SHA1

    dc3a116ed2eaed744dd1de412af7dced809a2ef2

  • SHA256

    68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349

  • SHA512

    7147ffac80a425cdbeb26dbc6510873bb7110f69f64e76ff8228b8f345510c4bf127326c4a05e30f5ec873242c39903897aaf04d6c6ceaa6f62dfea9402ba6c8

Score
10/10
massloggercollectionpersistencespywarestealer

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe
    "C:\Users\Admin\AppData\Local\Temp\68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe
      "C:\Users\Admin\AppData\Local\Temp\68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe"
      2⤵
        PID:4856
      • C:\Users\Admin\AppData\Local\Temp\68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe
        "C:\Users\Admin\AppData\Local\Temp\68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe"
        2⤵
        • Checks computer location settings
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1648
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4228

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\68eef92865b6139b72970c4fe508c5207714fed44b66c57bb8d3f5671b659349.exe.log
      Filesize

      321B

      MD5

      baf5d1398fdb79e947b60fe51e45397f

      SHA1

      49e7b8389f47b93509d621b8030b75e96bb577af

      SHA256

      10c8c7b5fa58f8c6b69f44e92a4e2af111b59fcf4f21a07e04b19e14876ccdf8

      SHA512

      b2c9ef5581d5eae7c17ae260fe9f52344ed737fa851cb44d1cea58a32359d0ac5d0ca3099c970209bd30a0d4af6e504101f21b7054cf5eca91c0831cf12fb413

      Download Submit

    • memory/1612-131-0x000000000AAB0000-0x000000000B054000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/1612-130-0x0000000000250000-0x0000000000382000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/1648-142-0x0000000006F30000-0x0000000006FCC000-memory.dmp

      Filesize

      624KB

      Download

    • memory/1648-141-0x0000000006C90000-0x0000000006C9A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1648-133-0x0000000000000000-mapping.dmp

      Download

    • memory/1648-136-0x00000000055A0000-0x0000000005632000-memory.dmp

      Filesize

      584KB

      Download

    • memory/1648-137-0x00000000064A0000-0x0000000006506000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1648-134-0x0000000000400000-0x0000000000486000-memory.dmp

      Filesize

      536KB

      Download

    • memory/1648-139-0x0000000006D50000-0x0000000006DA0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/4228-144-0x0000000005A30000-0x0000000005A52000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4228-149-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/4228-156-0x0000000007E90000-0x0000000007E98000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4228-143-0x0000000005A60000-0x0000000006088000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/4228-138-0x0000000000000000-mapping.dmp

      Download

    • memory/4228-145-0x0000000006100000-0x0000000006166000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4228-146-0x0000000006900000-0x000000000691E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/4228-147-0x0000000006EF0000-0x0000000006F22000-memory.dmp

      Filesize

      200KB

      Download

    • memory/4228-148-0x000000006F5F0000-0x000000006F63C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4228-140-0x0000000005320000-0x0000000005356000-memory.dmp

      Filesize

      216KB

      Download

    • memory/4228-150-0x0000000008290000-0x000000000890A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/4228-151-0x0000000007C10000-0x0000000007C2A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4228-152-0x0000000007C80000-0x0000000007C8A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4228-153-0x0000000007EB0000-0x0000000007F46000-memory.dmp

      Filesize

      600KB

      Download

    • memory/4228-154-0x0000000007E40000-0x0000000007E4E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4228-155-0x0000000007F50000-0x0000000007F6A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4856-132-0x0000000000000000-mapping.dmp

      Download