Overview

overview

10

Static

static

DHL Shipme...DF.exe

windows7_x64

10

DHL Shipme...DF.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 00:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DHL Shipment Notification,PDF.exe

  • Size

    978KB

  • MD5

    9800e94ddea9137c64f0125f8ed1697b

  • SHA1

    a482e5e542c30a7d64bf6173fef0ffac506b2839

  • SHA256

    192fd3e7ebbf5b338a50b735cd8eae792246e618e3434c1eb0c69f7ef0eb7e05

  • SHA512

    e03f859652d858c2d087d79d71e620e99b606a861dc2757a13261df6e77bb69910b576cd9e2af77a946cd070b4851f94d71c4d7c2e56556ddb3b372be7f3d69a

Score
10/10
massloggercollectionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:24:09 AM MassLogger Started: 5/21/2022 2:24:01 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:24:33 AM MassLogger Started: 5/21/2022 2:24:26 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:25:01 AM MassLogger Started: 5/21/2022 2:24:54 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Window Searcher ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:25:28 AM MassLogger Started: 5/21/2022 2:25:21 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Window Searcher ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main Payload 1 IoCs
  • MassLogger log file 4 IoCs

    Detects a log file produced by MassLogger.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs
    collection
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Checks computer location settings
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        PID:568
      • C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1840
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          PID:1604
        • C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe
          "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:280
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
            • Checks computer location settings
            • Accesses Microsoft Outlook profiles
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:456
          • C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe
            "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe"
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1828
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1112
            • C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe
              "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification,PDF.exe"
              6⤵
                PID:564

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/280-72-0x0000000000000000-mapping.dmp

      Download

    • memory/456-75-0x00000000004B342E-mapping.dmp

      Download

    • memory/456-79-0x00000000009D5000-0x00000000009E6000-memory.dmp

      Filesize

      68KB

      Download

    • memory/564-82-0x0000000000000000-mapping.dmp

      Download

    • memory/568-65-0x00000000004B342E-mapping.dmp

      Download

    • memory/568-69-0x0000000000D25000-0x0000000000D36000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1100-57-0x00000000004B342E-mapping.dmp

      Download

    • memory/1100-64-0x0000000000CB5000-0x0000000000CC6000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1100-61-0x0000000000F90000-0x0000000001008000-memory.dmp

      Filesize

      480KB

      Download

    • memory/1100-59-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

      Download

    • memory/1112-80-0x00000000004B342E-mapping.dmp

      Download

    • memory/1604-74-0x0000000004D15000-0x0000000004D26000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1604-70-0x00000000004B342E-mapping.dmp

      Download

    • memory/1708-62-0x0000000000000000-mapping.dmp

      Download

    • memory/1792-60-0x00000000003E0000-0x00000000003E3000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1792-54-0x0000000001060000-0x000000000115A000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/1792-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1792-55-0x0000000000F50000-0x0000000001010000-memory.dmp

      Filesize

      768KB

      Download

    • memory/1828-77-0x0000000000000000-mapping.dmp

      Download

    • memory/1840-67-0x0000000000000000-mapping.dmp

      Download