Analysis

  • max time kernel
    90s
  • max time network
    188s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    11-05-2022 14:09

General

  • Target

    44c94a4425f043b2ac158adc61d8ba53f7f178c47a6f1a6b97e4eeb74562f24c.exe

  • Size

    943KB

  • MD5

    95ebc8129fcaa10a9ef2e6bb8f6816a9

  • SHA1

    6a692e791f911b9cd187f8f349403df6369cb36b

  • SHA256

    44c94a4425f043b2ac158adc61d8ba53f7f178c47a6f1a6b97e4eeb74562f24c

  • SHA512

    09dba95ff2c436a46c73b36f7167bcb436431b4fdd9a617f4cfbe1732d794a4619517b9b6369a1cc564bfee1fe531c88c8a81af708c137b62e353065310a8a96

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ayo2018

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44c94a4425f043b2ac158adc61d8ba53f7f178c47a6f1a6b97e4eeb74562f24c.exe
    "C:\Users\Admin\AppData\Local\Temp\44c94a4425f043b2ac158adc61d8ba53f7f178c47a6f1a6b97e4eeb74562f24c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xLdJLGx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D81.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1136
    • C:\Users\Admin\AppData\Local\Temp\44c94a4425f043b2ac158adc61d8ba53f7f178c47a6f1a6b97e4eeb74562f24c.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1512

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp8D81.tmp

    Filesize

    1KB

    MD5

    23774ec582347a36dc91d666a352b0d7

    SHA1

    ae5bebd225debeb472494612d4eed0881cc7aba4

    SHA256

    d213e2b0f1aab14008360c319d4baf0c149d50e386f82f6dbf4cff7a48a57a81

    SHA512

    28ac0d3e8d2d008047a13f38a9334c0d8ffe20c644ba562c40abab3fc2fcd4f9a9ddd9c455a73c54338bc96e9beb493dcc0a8c496875ce09a65715d0890b7159

  • memory/1136-58-0x0000000000000000-mapping.dmp

  • memory/1512-63-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1512-64-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1512-74-0x0000000004CB5000-0x0000000004CC6000-memory.dmp

    Filesize

    68KB

  • memory/1512-73-0x0000000006520000-0x00000000065B0000-memory.dmp

    Filesize

    576KB

  • memory/1512-60-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1512-61-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1512-72-0x00000000043B0000-0x00000000043EE000-memory.dmp

    Filesize

    248KB

  • memory/1512-71-0x00000000764C1000-0x00000000764C3000-memory.dmp

    Filesize

    8KB

  • memory/1512-65-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1512-66-0x000000000048177E-mapping.dmp

  • memory/1512-68-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1512-70-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1528-57-0x0000000005430000-0x00000000054C8000-memory.dmp

    Filesize

    608KB

  • memory/1528-54-0x00000000009D0000-0x0000000000AC2000-memory.dmp

    Filesize

    968KB

  • memory/1528-55-0x0000000000230000-0x0000000000242000-memory.dmp

    Filesize

    72KB

  • memory/1528-56-0x00000000045B0000-0x0000000004650000-memory.dmp

    Filesize

    640KB