Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:40
General
-
Target
RQF.49254960 annex.exe
-
Size
1.1MB
-
MD5
05b38d4a44ea9242439c3143809cc1e5
-
SHA1
f0b6b086ae839312178d27ea01e8034cbefab227
-
SHA256
9d12d73cdddda4b11bbfa38b1bc056e20063a75f38decb5e8af5e6a30c078673
-
SHA512
e5123993d2631d6fb10f14b32ca3313979e6297716b29aa99081e134214c73ae49142c403a1288362dfc4d715a8791ade7ccb0d819d690b5f7561ab98012adb3
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt
Family
masslogger
Ransom Note
<|| v2.4.0.0 ||>
User Name: Admin
IP: 127.0.0.1
Location: United States
Windows OS: Microsoft Windows 7 Ultimate 64bit
Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV
CPU: Intel Core Processor (Broadwell)
GPU: Standard VGA Graphics Adapter
AV: NA
Screen Resolution: 1280x720
Current Time: 5/21/2022 2:56:08 AM
MassLogger Started: 5/21/2022 2:55:48 AM
Interval: 2 hour
MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RQF.49254960 annex.exe
MassLogger Melt: false
MassLogger Exit after delivery: false
As Administrator: True
Processes:
<|| WD Exclusion ||>
Disabled
<|| Binder ||>
Disabled
<|| Downloader ||>
Disabled
<|| Window Searcher ||>
Disabled
<|| Bot Killer ||>
Disabled
<|| Search And Upload ||>
Disabled
<|| Telegram Desktop ||>
Not Installed
<|| Pidgin ||>
Not Installed
<|| FileZilla ||>
Not Installed
<|| Discord Tokken ||>
Not Installed
<|| NordVPN ||>
Not Installed
<|| Outlook ||>
Not Installed
<|| FoxMail ||>
Not Installed
<|| Thunderbird ||>
Not Installed
<|| FireFox ||>
Not Found
<|| QQ Browser ||>
Not Installed
<|| Chromium Recovery ||>
Not Installed or Not Found
<|| Keylogger And Clipboard ||>
NA
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RQF.49254960 annex.exe"C:\Users\Admin\AppData\Local\Temp\RQF.49254960 annex.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RQF.49254960 annex.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736KB
-
-
Filesize
68KB
-
Filesize
480KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
776KB
-
Filesize
816KB
-
Filesize
32KB