Overview

overview

10

Static

static

RFQ_PCPSPI...22.exe

windows7_x64

10

RFQ_PCPSPI...22.exe

windows10-2004_x64

9

Analysis

  • max time kernel
    130s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 22:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RFQ_PCPSPIRSZ2020022.exe

  • Size

    895KB

  • MD5

    78b61b1e9b375628d02bf7d289b1aeab

  • SHA1

    f861925e28320134d0458100c9898d6fdd8c0154

  • SHA256

    a551bc2327862c1430dac51dce368001622525fae235ca689f7b055e0d3125c7

  • SHA512

    05cd3aeefb9fee84c813af2951eccf2b5c2e1679a3fe892cdd9d6a37cc215064bde4e9a39f41c1afbba9e672020a1f7e5a7c25452f01ffe91ec54de48c2ef3cd

Score
10/10
massloggercollectionevasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:37:36 AM MassLogger Started: 5/21/2022 12:37:29 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Done! C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Killed : 0 malware <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dTPwlukysvENt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3FEE.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1760
    • C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe
      "{path}"
      2⤵
        PID:2032
      • C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe
        "{path}"
        2⤵
          PID:1260
        • C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe
          "{path}"
          2⤵
            PID:1008
          • C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe
            "{path}"
            2⤵
              PID:1376
            • C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe
              "{path}"
              2⤵
              • Checks computer location settings
              • Accesses Microsoft Outlook profiles
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • outlook_office_path
              • outlook_win_path
              PID:1616
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c start /b powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe' & exit
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1860
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RFQ_PCPSPIRSZ2020022.exe'
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2000

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Scheduled Task

          1
          T1053

          Persistence

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          Query Registry

          5
          T1012

          Virtualization/Sandbox Evasion

          2
          T1497

          System Information Discovery

          4
          T1082

          Peripheral Device Discovery

          1
          T1120

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Email Collection

          1
          T1114

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp3FEE.tmp
            Filesize

            1KB

            MD5

            61939d6f55a89ab30af39d0c78d6cfa0

            SHA1

            7263b518587090980e8666cf2aaf5fd5bb9834fb

            SHA256

            c1a6b3620f0e2fbb781306acd39b1676155e2a3a9013ecb5151a8e41ff6d9283

            SHA512

            06d6044a8e0f12c3b874d721f14b7d535c82fe24dca2109e2b45453181827f5662fcf1c8e4a289ecf47ef68396522fecf841fc2e6b483b3f4f38d94fe1c7ccc6

            Download Submit
          • memory/1616-72-0x00000000022F0000-0x0000000002368000-memory.dmp
            Filesize

            480KB

            Download
          • memory/1616-66-0x0000000000400000-0x00000000004B8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1616-62-0x0000000000400000-0x00000000004B8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1616-65-0x0000000000400000-0x00000000004B8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1616-77-0x00000000022B5000-0x00000000022C6000-memory.dmp
            Filesize

            68KB

            Download
          • memory/1616-61-0x0000000000400000-0x00000000004B8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1616-64-0x0000000000400000-0x00000000004B8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1616-69-0x0000000000400000-0x00000000004B8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1616-71-0x0000000000400000-0x00000000004B8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1616-67-0x00000000004B30EE-mapping.dmp
            Download
          • memory/1760-59-0x0000000000000000-mapping.dmp
            Download
          • memory/1828-55-0x0000000075541000-0x0000000075543000-memory.dmp
            Filesize

            8KB

            Download
          • memory/1828-57-0x0000000007730000-0x00000000077F0000-memory.dmp
            Filesize

            768KB

            Download
          • memory/1828-54-0x00000000000F0000-0x00000000001D6000-memory.dmp
            Filesize

            920KB

            Download
          • memory/1828-56-0x0000000000590000-0x000000000059A000-memory.dmp
            Filesize

            40KB

            Download
          • memory/1828-58-0x0000000007F40000-0x0000000007FF8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1860-74-0x0000000000000000-mapping.dmp
            Download
          • memory/2000-78-0x000000006E910000-0x000000006EEBB000-memory.dmp
            Filesize

            5.7MB

            Download
          • memory/2000-75-0x0000000000000000-mapping.dmp
            Download