Analysis
-
max time kernel
158s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:36
Static task
static1
Behavioral task
behavioral1
Sample
LEE KEE METAL CO. LTD Quotation.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
LEE KEE METAL CO. LTD Quotation.exe
Resource
win10v2004-20220414-en
General
-
Target
LEE KEE METAL CO. LTD Quotation.exe
-
Size
800KB
-
MD5
e0b609a21c0ce30fd3af290eea01b223
-
SHA1
89ebb9ff3ab6c9a3330e798036bb81cec29c417f
-
SHA256
4e58097d79300ae809d5217574143329645024690feef18106d9f009653fbb95
-
SHA512
c51ed371b07bb7949b861f7e5e7a26e08d8f09a884d3fc468a1e7072cb9dd23f26b7c73d0e322101f5a0aad14a83c673e446f360b710443205897add976f4810
Malware Config
Extracted
C:\Users\Admin\AppData\Local\8236ADF044\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LEE KEE METAL CO. LTD Quotation.exeLEE KEE METAL CO. LTD Quotation.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation LEE KEE METAL CO. LTD Quotation.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation LEE KEE METAL CO. LTD Quotation.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
LEE KEE METAL CO. LTD Quotation.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 api.ipify.org 36 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LEE KEE METAL CO. LTD Quotation.exedescription pid process target process PID 1812 set thread context of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
LEE KEE METAL CO. LTD Quotation.exeLEE KEE METAL CO. LTD Quotation.exepid process 1812 LEE KEE METAL CO. LTD Quotation.exe 1812 LEE KEE METAL CO. LTD Quotation.exe 1812 LEE KEE METAL CO. LTD Quotation.exe 1812 LEE KEE METAL CO. LTD Quotation.exe 2324 LEE KEE METAL CO. LTD Quotation.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
LEE KEE METAL CO. LTD Quotation.exeLEE KEE METAL CO. LTD Quotation.exedescription pid process Token: SeDebugPrivilege 1812 LEE KEE METAL CO. LTD Quotation.exe Token: SeDebugPrivilege 2324 LEE KEE METAL CO. LTD Quotation.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LEE KEE METAL CO. LTD Quotation.exedescription pid process target process PID 1812 wrote to memory of 4736 1812 LEE KEE METAL CO. LTD Quotation.exe schtasks.exe PID 1812 wrote to memory of 4736 1812 LEE KEE METAL CO. LTD Quotation.exe schtasks.exe PID 1812 wrote to memory of 4736 1812 LEE KEE METAL CO. LTD Quotation.exe schtasks.exe PID 1812 wrote to memory of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe PID 1812 wrote to memory of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe PID 1812 wrote to memory of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe PID 1812 wrote to memory of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe PID 1812 wrote to memory of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe PID 1812 wrote to memory of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe PID 1812 wrote to memory of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe PID 1812 wrote to memory of 2324 1812 LEE KEE METAL CO. LTD Quotation.exe LEE KEE METAL CO. LTD Quotation.exe -
outlook_office_path 1 IoCs
Processes:
LEE KEE METAL CO. LTD Quotation.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe -
outlook_win_path 1 IoCs
Processes:
LEE KEE METAL CO. LTD Quotation.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LEE KEE METAL CO. LTD Quotation.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LEE KEE METAL CO. LTD Quotation.exe"C:\Users\Admin\AppData\Local\Temp\LEE KEE METAL CO. LTD Quotation.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZNlSpLGO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp971F.tmp"2⤵
- Creates scheduled task(s)
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\LEE KEE METAL CO. LTD Quotation.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2324
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LEE KEE METAL CO. LTD Quotation.exe.log
Filesize1KB
MD56dcfdb496c3cf0a736b09292618b380d
SHA159d3aecbd319c9b48d500b51a093ee48d02af334
SHA256cb5dcf594045c8b7a5f87e8a12eabbd3e53e673654926027627ed79ef3e2a203
SHA5129b7d22dc9e40d11693f7191f7b075a78974322af145010e66b19d989e678477dfe4741e88d02929d5b37236276f4605bc23a7adbedf43b66cd3c4e5e7b7e67ff
-
Filesize
1KB
MD5506aa64f0d24a4559371c98fafc56c20
SHA13dd9df82032752c7b52f1b318247cc618297d0ba
SHA256f5e03d09815139ffb32517f2d64ee2c01c69647ee4bfc7ccd65a10de3cac104b
SHA512654d6032e98ec84153bdd8cc6b8cda00182ead35e29bd5e3f2a4451feb6f557d8efe8d916f6f82fd3fd2f2cbf072dce4bbfae3233d63bdba3d62e6474c3878f1