Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 14:29
Static task
static1
Behavioral task
behavioral1
Sample
OC_Y590382614.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
OC_Y590382614.exe
Resource
win10v2004-20220414-en
General
-
Target
OC_Y590382614.exe
-
Size
1.2MB
-
MD5
702a370d537ad9909efe4645ff854a3e
-
SHA1
cd7dc538b01dea63f5c619ebe4de89ba75b3a245
-
SHA256
c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9
-
SHA512
b2bca63f30b8d2848b70321201a36ad87de841325374fc8ae350ea9dc9d5894d7bfc333802e24054b9653b3f7ac150a658acffb86c1460cf31f828d2393a814d
Malware Config
Extracted
C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1388-70-0x0000000001F50000-0x0000000002008000-memory.dmp family_masslogger behavioral1/memory/1388-71-0x0000000001F50000-0x0000000002008000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 3 IoCs
Processes:
app.exeapp.exeapp.exepid process 976 app.exe 1388 app.exe 1152 app.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
app.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation app.exe -
Loads dropped DLL 2 IoCs
Processes:
notepad.exepid process 1552 notepad.exe 1552 notepad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
app.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook app.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
app.exedescription pid process target process PID 976 set thread context of 1388 976 app.exe app.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\app.exe:ZoneIdentifier notepad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
OC_Y590382614.exeapp.exeapp.exeapp.exepid process 1304 OC_Y590382614.exe 976 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1388 app.exe 1388 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1388 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe 1152 app.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
app.exepid process 976 app.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
app.exedescription pid process Token: SeDebugPrivilege 1388 app.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
OC_Y590382614.exenotepad.exeapp.exedescription pid process target process PID 1304 wrote to memory of 1552 1304 OC_Y590382614.exe notepad.exe PID 1304 wrote to memory of 1552 1304 OC_Y590382614.exe notepad.exe PID 1304 wrote to memory of 1552 1304 OC_Y590382614.exe notepad.exe PID 1304 wrote to memory of 1552 1304 OC_Y590382614.exe notepad.exe PID 1304 wrote to memory of 1552 1304 OC_Y590382614.exe notepad.exe PID 1304 wrote to memory of 1552 1304 OC_Y590382614.exe notepad.exe PID 1552 wrote to memory of 976 1552 notepad.exe app.exe PID 1552 wrote to memory of 976 1552 notepad.exe app.exe PID 1552 wrote to memory of 976 1552 notepad.exe app.exe PID 1552 wrote to memory of 976 1552 notepad.exe app.exe PID 976 wrote to memory of 1388 976 app.exe app.exe PID 976 wrote to memory of 1388 976 app.exe app.exe PID 976 wrote to memory of 1388 976 app.exe app.exe PID 976 wrote to memory of 1388 976 app.exe app.exe PID 976 wrote to memory of 1152 976 app.exe app.exe PID 976 wrote to memory of 1152 976 app.exe app.exe PID 976 wrote to memory of 1152 976 app.exe app.exe PID 976 wrote to memory of 1152 976 app.exe app.exe -
outlook_office_path 1 IoCs
Processes:
app.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe -
outlook_win_path 1 IoCs
Processes:
app.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 app.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OC_Y590382614.exe"C:\Users\Admin\AppData\Local\Temp\OC_Y590382614.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Roaming\appdata\app.exe"C:\Users\Admin\AppData\Roaming\appdata\app.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Roaming\appdata\app.exe"C:\Users\Admin\AppData\Roaming\appdata\app.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1388 -
C:\Users\Admin\AppData\Roaming\appdata\app.exe"C:\Users\Admin\AppData\Roaming\appdata\app.exe" 2 1388 70931784⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1152
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5702a370d537ad9909efe4645ff854a3e
SHA1cd7dc538b01dea63f5c619ebe4de89ba75b3a245
SHA256c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9
SHA512b2bca63f30b8d2848b70321201a36ad87de841325374fc8ae350ea9dc9d5894d7bfc333802e24054b9653b3f7ac150a658acffb86c1460cf31f828d2393a814d
-
Filesize
1.2MB
MD5702a370d537ad9909efe4645ff854a3e
SHA1cd7dc538b01dea63f5c619ebe4de89ba75b3a245
SHA256c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9
SHA512b2bca63f30b8d2848b70321201a36ad87de841325374fc8ae350ea9dc9d5894d7bfc333802e24054b9653b3f7ac150a658acffb86c1460cf31f828d2393a814d
-
Filesize
1.2MB
MD5702a370d537ad9909efe4645ff854a3e
SHA1cd7dc538b01dea63f5c619ebe4de89ba75b3a245
SHA256c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9
SHA512b2bca63f30b8d2848b70321201a36ad87de841325374fc8ae350ea9dc9d5894d7bfc333802e24054b9653b3f7ac150a658acffb86c1460cf31f828d2393a814d
-
Filesize
1.2MB
MD5702a370d537ad9909efe4645ff854a3e
SHA1cd7dc538b01dea63f5c619ebe4de89ba75b3a245
SHA256c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9
SHA512b2bca63f30b8d2848b70321201a36ad87de841325374fc8ae350ea9dc9d5894d7bfc333802e24054b9653b3f7ac150a658acffb86c1460cf31f828d2393a814d
-
Filesize
1.2MB
MD5702a370d537ad9909efe4645ff854a3e
SHA1cd7dc538b01dea63f5c619ebe4de89ba75b3a245
SHA256c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9
SHA512b2bca63f30b8d2848b70321201a36ad87de841325374fc8ae350ea9dc9d5894d7bfc333802e24054b9653b3f7ac150a658acffb86c1460cf31f828d2393a814d
-
Filesize
1.2MB
MD5702a370d537ad9909efe4645ff854a3e
SHA1cd7dc538b01dea63f5c619ebe4de89ba75b3a245
SHA256c7202ac90daa5d696736a32eff2c930eba08332c9416ff6a464ce3ea17f414f9
SHA512b2bca63f30b8d2848b70321201a36ad87de841325374fc8ae350ea9dc9d5894d7bfc333802e24054b9653b3f7ac150a658acffb86c1460cf31f828d2393a814d