Overview

overview

10

Static

static

DHL ARRIVA...RT.exe

windows7_x64

10

DHL ARRIVA...RT.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 23:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DHL ARRIVAL SHIPMENT PRE-ALERT.exe

  • Size

    1.0MB

  • MD5

    d66436765b3cb3dc1a97beab0c6c7ae2

  • SHA1

    bb5f32c172af5efd89c25960bed8edc76467a9b9

  • SHA256

    dc05645067f3f3ccf6a4e647dcf935c928fd981ef904672603a7ab409488166e

  • SHA512

    5591c88812f92ce11bbc87c01dceba3de905c5b7473582f2eb58f91929da4baf1bf44b5beb025d97027b85152969a64ef9c680881e4f30f7ac3a58a4e707e8a3

Score
10/10
massloggercollectionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\0F48153F20\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/20/2022 11:25:29 PM MassLogger Started: 5/20/2022 11:25:25 PM Interval: 3 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL ARRIVAL SHIPMENT PRE-ALERT.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL ARRIVAL SHIPMENT PRE-ALERT.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL ARRIVAL SHIPMENT PRE-ALERT.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\icBEmexdsavHL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp75BC.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3848
    • C:\Users\Admin\AppData\Local\Temp\DHL ARRIVAL SHIPMENT PRE-ALERT.exe
      "{path}"
      2⤵
        PID:4424
      • C:\Users\Admin\AppData\Local\Temp\DHL ARRIVAL SHIPMENT PRE-ALERT.exe
        "{path}"
        2⤵
        • Checks computer location settings
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:4300

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Email Collection

    1
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL ARRIVAL SHIPMENT PRE-ALERT.exe.log
      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\tmp75BC.tmp
      Filesize

      1KB

      MD5

      b689e5f7eed95113fd776605a2aed00d

      SHA1

      3184180d1b206cf18221da9992b43cfcb44b32c8

      SHA256

      76f3e736016a2a74e2860928d0cb8be8e28dae8986775eb2f9a32a57c46a1ae9

      SHA512

      631f1219c170d7bdbcdc1b8f781a8e94e6ddbc2e8fb0e980d236035ba12730a222ea790b6e8779cd42ecc1b550ae426c042710c74fbb14c19afc6f06a6b57014

      Download Submit
    • memory/3848-135-0x0000000000000000-mapping.dmp
      Download
    • memory/4300-139-0x0000000000400000-0x00000000004B8000-memory.dmp
      Filesize

      736KB

      Download
    • memory/4300-138-0x0000000000000000-mapping.dmp
      Download
    • memory/4300-141-0x0000000005400000-0x0000000005466000-memory.dmp
      Filesize

      408KB

      Download
    • memory/4300-142-0x0000000007A90000-0x0000000007AE0000-memory.dmp
      Filesize

      320KB

      Download
    • memory/4304-134-0x0000000007BB0000-0x0000000007C4C000-memory.dmp
      Filesize

      624KB

      Download
    • memory/4304-133-0x00000000050A0000-0x00000000050AA000-memory.dmp
      Filesize

      40KB

      Download
    • memory/4304-132-0x0000000004F10000-0x0000000004FA2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4304-130-0x0000000000440000-0x0000000000554000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/4304-131-0x00000000054C0000-0x0000000005A64000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4424-137-0x0000000000000000-mapping.dmp
      Download