Analysis
-
max time kernel
124s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:18
Static task
static1
Behavioral task
behavioral1
Sample
FENG 2910836.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
FENG 2910836.exe
Resource
win10v2004-20220414-en
General
-
Target
FENG 2910836.exe
-
Size
1.2MB
-
MD5
299676e378f6b117acf153c945be8aa7
-
SHA1
fba3938d5185ebdbc79d60eba8171b27bcc999cb
-
SHA256
ac8a7922316a93951a4e2033fda200c5742a67daf9a3f1005a67d85466981b97
-
SHA512
09c5a9816a6c26285f32535b3bdc2b9a5de90fbc2839c05c4a1947b9b3537281e8e2f3624b79f9afffbd0a34404e6895707ba8184c247016c148525ac28935b8
Malware Config
Extracted
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
ayo2018
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FENG 2910836.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation FENG 2910836.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
FENG 2910836.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook FENG 2910836.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook FENG 2910836.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook FENG 2910836.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook FENG 2910836.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FENG 2910836.exedescription pid process target process PID 2020 set thread context of 268 2020 FENG 2910836.exe FENG 2910836.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
FENG 2910836.exepid process 268 FENG 2910836.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
FENG 2910836.exeFENG 2910836.exepid process 2020 FENG 2910836.exe 2020 FENG 2910836.exe 2020 FENG 2910836.exe 2020 FENG 2910836.exe 2020 FENG 2910836.exe 268 FENG 2910836.exe 268 FENG 2910836.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
FENG 2910836.exeFENG 2910836.exedescription pid process Token: SeDebugPrivilege 2020 FENG 2910836.exe Token: SeDebugPrivilege 268 FENG 2910836.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
FENG 2910836.exepid process 268 FENG 2910836.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
FENG 2910836.exedescription pid process target process PID 2020 wrote to memory of 952 2020 FENG 2910836.exe schtasks.exe PID 2020 wrote to memory of 952 2020 FENG 2910836.exe schtasks.exe PID 2020 wrote to memory of 952 2020 FENG 2910836.exe schtasks.exe PID 2020 wrote to memory of 952 2020 FENG 2910836.exe schtasks.exe PID 2020 wrote to memory of 1832 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 1832 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 1832 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 1832 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 764 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 764 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 764 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 764 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe PID 2020 wrote to memory of 268 2020 FENG 2910836.exe FENG 2910836.exe -
outlook_office_path 1 IoCs
Processes:
FENG 2910836.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe -
outlook_win_path 1 IoCs
Processes:
FENG 2910836.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FENG 2910836.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FENG 2910836.exe"C:\Users\Admin\AppData\Local\Temp\FENG 2910836.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\equUeGsADNjA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBDB5.tmp"2⤵
- Creates scheduled task(s)
PID:952 -
C:\Users\Admin\AppData\Local\Temp\FENG 2910836.exe"{path}"2⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\FENG 2910836.exe"{path}"2⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\FENG 2910836.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:268
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBDB5.tmpFilesize
1KB
MD55496292afc1557ffb8b9dce523d329e1
SHA10641c51e312a0c8b4ec28975e2b1511bbe366248
SHA256b694a383e6d9a4f7a227edb5a06dbd6f3fb75bb02b88f6dce00e14d1c2638309
SHA512ccbd505ccfe7e0fac63d6e895dd3e5f5417ccdbb83d76f0f23f4525e82aabc2b6e4e42f59a7f76e8fc3ef727cbc7aeac97a90c327b56b2e16a4c8cb4b59ba04f
-
memory/268-66-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/268-61-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/268-74-0x0000000004EB5000-0x0000000004EC6000-memory.dmpFilesize
68KB
-
memory/268-72-0x0000000002260000-0x00000000022D8000-memory.dmpFilesize
480KB
-
memory/268-64-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/268-71-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/268-69-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/268-62-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/268-67-0x00000000004B30FE-mapping.dmp
-
memory/268-65-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/952-59-0x0000000000000000-mapping.dmp
-
memory/2020-54-0x0000000000060000-0x0000000000190000-memory.dmpFilesize
1.2MB
-
memory/2020-56-0x00000000005C0000-0x00000000005D0000-memory.dmpFilesize
64KB
-
memory/2020-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/2020-58-0x0000000005930000-0x00000000059E8000-memory.dmpFilesize
736KB
-
memory/2020-57-0x0000000005140000-0x00000000051FA000-memory.dmpFilesize
744KB