Overview

overview

10

Static

static

68dde9189f...3c.exe

windows7_x64

10

68dde9189f...3c.exe

windows10-2004_x64

7

Analysis

  • max time kernel
    69s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-04-2022 05:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68dde9189f9908b3ae89d17df74459367fa3a22de1a9baf1426f5384f6a6c83c.exe

  • Size

    962KB

  • MD5

    a45b5331745c5eeb129b12aec82873e8

  • SHA1

    db18b7c9642801f2ceede98250d72c9119637984

  • SHA256

    68dde9189f9908b3ae89d17df74459367fa3a22de1a9baf1426f5384f6a6c83c

  • SHA512

    2785a00e29a0f65898f59317a6eca519a4715257894493e40c3d5ca948ad94a6e0c58f80e645ab9539d39a5e9e72296f789586c939f7233e749f96f7ff7e7035

Score
10/10
massloggercollectionspywarestealer

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main Payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68dde9189f9908b3ae89d17df74459367fa3a22de1a9baf1426f5384f6a6c83c.exe
    "C:\Users\Admin\AppData\Local\Temp\68dde9189f9908b3ae89d17df74459367fa3a22de1a9baf1426f5384f6a6c83c.exe"
    1⤵
    • Checks computer location settings
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • outlook_office_path
    • outlook_win_path
    PID:1044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1044-54-0x00000000012F0000-0x00000000013E6000-memory.dmp

    Filesize

    984KB

    Download

  • memory/1044-55-0x00000000047F0000-0x0000000004858000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1044-56-0x0000000004860000-0x00000000048E6000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1044-57-0x0000000000445000-0x0000000000456000-memory.dmp

    Filesize

    68KB

    Download