Analysis
-
max time kernel
153s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 14:58
Static task
static1
Behavioral task
behavioral1
Sample
chibyke03.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
chibyke03.exe
Resource
win10v2004-20220414-en
General
-
Target
chibyke03.exe
-
Size
1.0MB
-
MD5
d9d969b4d51b61c1f2e62305fcb8ba1b
-
SHA1
f98d039477e9c5f531a7f809dc7686e69ed5aff1
-
SHA256
8e351736ae4bff938f1b59b396f039a6a281c4b8401f918f6b7b52b5c574d330
-
SHA512
95f7b868951e3bc9867478df083b2fb43807ef053dcee05c6bd3e3d78d466b885309a7c2a5b65bfc8b41bef35ec89fa01edeead4f7cf63b82103677812cfa912
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/432-134-0x00000000009C0000-0x0000000000A46000-memory.dmp family_masslogger behavioral2/memory/432-135-0x00000000009C0000-0x0000000000A46000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
chibyke03.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation chibyke03.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
chibyke03.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook chibyke03.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook chibyke03.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook chibyke03.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook chibyke03.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook chibyke03.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 23 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chibyke03.exedescription pid process target process PID 1320 set thread context of 432 1320 chibyke03.exe chibyke03.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
chibyke03.exepid process 432 chibyke03.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chibyke03.exechibyke03.exechibyke03.exepid process 1320 chibyke03.exe 1320 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 432 chibyke03.exe 432 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe 5100 chibyke03.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
chibyke03.exepid process 1320 chibyke03.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
chibyke03.exedescription pid process Token: SeDebugPrivilege 432 chibyke03.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
chibyke03.exepid process 432 chibyke03.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
chibyke03.exedescription pid process target process PID 1320 wrote to memory of 432 1320 chibyke03.exe chibyke03.exe PID 1320 wrote to memory of 432 1320 chibyke03.exe chibyke03.exe PID 1320 wrote to memory of 432 1320 chibyke03.exe chibyke03.exe PID 1320 wrote to memory of 5100 1320 chibyke03.exe chibyke03.exe PID 1320 wrote to memory of 5100 1320 chibyke03.exe chibyke03.exe PID 1320 wrote to memory of 5100 1320 chibyke03.exe chibyke03.exe -
outlook_office_path 1 IoCs
Processes:
chibyke03.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe -
outlook_win_path 1 IoCs
Processes:
chibyke03.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 chibyke03.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\chibyke03.exe"C:\Users\Admin\AppData\Local\Temp\chibyke03.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\chibyke03.exe"C:\Users\Admin\AppData\Local\Temp\chibyke03.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:432 -
C:\Users\Admin\AppData\Local\Temp\chibyke03.exe"C:\Users\Admin\AppData\Local\Temp\chibyke03.exe" 2 432 2405590152⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100