Analysis
-
max time kernel
75s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-05-2022 06:29
Static task
static1
Behavioral task
behavioral1
Sample
7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe
Resource
win10v2004-20220414-en
General
-
Target
7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe
-
Size
956KB
-
MD5
61d1229b0d488254e427690371417bad
-
SHA1
a5b44ab6d137d29a46b38926b95c6d3c70fb6c8d
-
SHA256
7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74
-
SHA512
5f865181f4b1d683c51f5e044f12be4987a3fbf4047d7f424f7805f3d350298f0b889910f9be423f5b8a5912dd137dced5f9e4c84575199edfd73d28d1ff1b27
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1332-62-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1332-63-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1332-64-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1332-65-0x000000000048127E-mapping.dmp family_masslogger behavioral1/memory/1332-67-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/1332-69-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exedescription pid process target process PID 884 set thread context of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exeMSBuild.exepowershell.exepid process 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe 1332 MSBuild.exe 1332 MSBuild.exe 1332 MSBuild.exe 1728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exeMSBuild.exepowershell.exedescription pid process Token: SeDebugPrivilege 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe Token: SeDebugPrivilege 1332 MSBuild.exe Token: SeDebugPrivilege 1728 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exeMSBuild.exedescription pid process target process PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 884 wrote to memory of 1332 884 7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe MSBuild.exe PID 1332 wrote to memory of 1728 1332 MSBuild.exe powershell.exe PID 1332 wrote to memory of 1728 1332 MSBuild.exe powershell.exe PID 1332 wrote to memory of 1728 1332 MSBuild.exe powershell.exe PID 1332 wrote to memory of 1728 1332 MSBuild.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe"C:\Users\Admin\AppData\Local\Temp\7cd8e8bdf19cbdf511d7807ff8233413c544efeb9518e2171a4151790e9d2f74.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-54-0x0000000000CC0000-0x0000000000DB6000-memory.dmpFilesize
984KB
-
memory/884-55-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/884-56-0x00000000003A0000-0x00000000003AA000-memory.dmpFilesize
40KB
-
memory/884-57-0x0000000005720000-0x00000000057E0000-memory.dmpFilesize
768KB
-
memory/884-58-0x0000000005AE0000-0x0000000005B9C000-memory.dmpFilesize
752KB
-
memory/1332-63-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1332-60-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1332-62-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1332-59-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1332-64-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1332-65-0x000000000048127E-mapping.dmp
-
memory/1332-67-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1332-69-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/1332-73-0x0000000004DA5000-0x0000000004DB6000-memory.dmpFilesize
68KB
-
memory/1728-71-0x0000000000000000-mapping.dmp
-
memory/1728-74-0x000000006EE80000-0x000000006F42B000-memory.dmpFilesize
5.7MB