masslogger | 70b7e90d998239e628bb364f5d9d625d53a82318103b3da59810af74681f277c

General

Target

Urgent request for Quotation.exe
Size

3.3MB
MD5

62a7d430071026ab9826285d60354082
SHA1

fc028f6a25a1acd1f0741669bd257fa65aa87cdb
SHA256

d149c44a5c8f9d0589498409795b1e37bc9caf8bd3a41b50b0ab97a80ba096b7
SHA512

8611907c264600b72d2f517b396006d99869be932e3303af4aaa45e3e580348bbc6778baadfea2f3729dd0d5690a74988f5bac840f1f502b1cb801a6c8ab7f88

Score

10^/10

masslogger collection spyware stealer upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
webmail.argo.com.br
Port:
587
Username:
[email protected]
Password:
argo2019xa

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dll	upx

Drops startup file 1 IoCs

Processes:

Urgent request for Quotation.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Taskmgr.url	Urgent request for Quotation.exe

Loads dropped DLL 1 IoCs

Processes:

MSBuild.exe

pid process

4576 MSBuild.exe

pid	process
4576	MSBuild.exe

Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

30 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Urgent request for Quotation.exe

description pid process target process

PID 4880 set thread context of 4576 4880 Urgent request for Quotation.exe MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 4576 MSBuild.exe

flow	ioc
30	api.ipify.org

description	pid	process	target process
PID 4880 set thread context of 4576	4880	Urgent request for Quotation.exe	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	4576	MSBuild.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Urgent request for Quotation.exe

pid	process
4880	Urgent request for Quotation.exe
4880	Urgent request for Quotation.exe
4880	Urgent request for Quotation.exe
4880	Urgent request for Quotation.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Urgent request for Quotation.exe

pid	process
4880	Urgent request for Quotation.exe
4880	Urgent request for Quotation.exe
4880	Urgent request for Quotation.exe
4880	Urgent request for Quotation.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Urgent request for Quotation.exe

description	pid	process	target process
PID 4880 wrote to memory of 4576	4880	Urgent request for Quotation.exe	MSBuild.exe
PID 4880 wrote to memory of 4576	4880	Urgent request for Quotation.exe	MSBuild.exe
PID 4880 wrote to memory of 4576	4880	Urgent request for Quotation.exe	MSBuild.exe
PID 4880 wrote to memory of 4576	4880	Urgent request for Quotation.exe	MSBuild.exe
PID 4880 wrote to memory of 4576	4880	Urgent request for Quotation.exe	MSBuild.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Urgent request for Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent request for Quotation.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dll
Filesize
594KB

MD5
e81aeac387c5db32b7f9b07d15e788e0

SHA1
829be6eaf1cb0d82b2ddfc98272e1087f4a7a7c3

SHA256
44f31f99f048bfc5195937353b5207332e455bcd5a722bcfd32cacfd93f60f06

SHA512
cc6a96325a01c50c059706a1f4156f109e502ef9c0b0f5de209d1f52e7cc973cebc027f57ed988e9d1b8fca62746b60ee7430d608de95cdd0e5ac3cb61fbe32e

Download Submit
memory/4576-131-0x0000000000000000-mapping.dmp

Download
memory/4576-133-0x0000000000502000-0x000000000065A000-memory.dmp

Filesize
1.3MB

Download
memory/4576-134-0x0000000000500000-0x000000000065E000-memory.dmp

Filesize
1.4MB

Download
memory/4576-418-0x0000000005210000-0x00000000057B4000-memory.dmp

Filesize
5.6MB

Download
memory/4576-419-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/4576-420-0x00000000059C0000-0x0000000005A26000-memory.dmp

Filesize
408KB

Download
memory/4576-421-0x0000000005D90000-0x0000000005D9A000-memory.dmp

Filesize
40KB

Download
memory/4576-422-0x0000000006160000-0x00000000061B0000-memory.dmp

Filesize
320KB

Download
memory/4576-423-0x0000000006740000-0x00000000067DC000-memory.dmp

Filesize
624KB

Download
memory/4880-130-0x00000000056B0000-0x0000000005962000-memory.dmp

Filesize
2.7MB

Download
memory/4880-137-0x0000000005970000-0x0000000005C22000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads