Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:41
Static task
static1
Behavioral task
behavioral1
Sample
Q2020-07-466am.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Q2020-07-466am.exe
Resource
win10v2004-20220414-en
General
-
Target
Q2020-07-466am.exe
-
Size
1.4MB
-
MD5
93a02efc3319e40884d86f0603d6073d
-
SHA1
df7966c6dda6c785ad4bcf5b7a49f0a99a9bc51e
-
SHA256
de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78
-
SHA512
620172b1822721b279eb1b92d288a2ee82056b77c91c59134edc1aa727524bee2e5211cc41d69e67b1dc1caf9c555e5f475b3fca97d3dd3b94b224443e5fc2c7
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1700-54-0x0000000000F20000-0x0000000001086000-memory.dmp family_masslogger \Users\Admin\AppData\Roaming\chulo.exe family_masslogger C:\Users\Admin\AppData\Roaming\chulo.exe family_masslogger C:\Users\Admin\AppData\Roaming\chulo.exe family_masslogger behavioral1/memory/1856-64-0x00000000008F0000-0x0000000000A56000-memory.dmp family_masslogger behavioral1/memory/1512-71-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-72-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-73-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-74-0x00000000004ACB6E-mapping.dmp family_masslogger behavioral1/memory/1512-77-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-79-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-81-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-83-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-85-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-87-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-89-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-91-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-93-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-95-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-97-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-99-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-101-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-103-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-105-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-107-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-109-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-111-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-113-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-115-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-117-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-119-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-121-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-123-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-125-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-127-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-129-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral1/memory/1512-131-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 2 IoCs
Processes:
chulo.exeInstallUtil.exepid process 1856 chulo.exe 1512 InstallUtil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
InstallUtil.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation InstallUtil.exe -
Loads dropped DLL 2 IoCs
Processes:
Q2020-07-466am.exechulo.exepid process 1700 Q2020-07-466am.exe 1856 chulo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\chulo = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\chulo.exe" reg.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chulo.exedescription pid process target process PID 1856 set thread context of 1512 1856 chulo.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
InstallUtil.exepid process 1512 InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Q2020-07-466am.exechulo.exeInstallUtil.exepid process 1700 Q2020-07-466am.exe 1700 Q2020-07-466am.exe 1856 chulo.exe 1856 chulo.exe 1856 chulo.exe 1512 InstallUtil.exe 1512 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Q2020-07-466am.exechulo.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1700 Q2020-07-466am.exe Token: SeDebugPrivilege 1856 chulo.exe Token: SeDebugPrivilege 1512 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 1512 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Q2020-07-466am.execmd.exechulo.exedescription pid process target process PID 1700 wrote to memory of 856 1700 Q2020-07-466am.exe cmd.exe PID 1700 wrote to memory of 856 1700 Q2020-07-466am.exe cmd.exe PID 1700 wrote to memory of 856 1700 Q2020-07-466am.exe cmd.exe PID 1700 wrote to memory of 856 1700 Q2020-07-466am.exe cmd.exe PID 856 wrote to memory of 1812 856 cmd.exe reg.exe PID 856 wrote to memory of 1812 856 cmd.exe reg.exe PID 856 wrote to memory of 1812 856 cmd.exe reg.exe PID 856 wrote to memory of 1812 856 cmd.exe reg.exe PID 1700 wrote to memory of 1856 1700 Q2020-07-466am.exe chulo.exe PID 1700 wrote to memory of 1856 1700 Q2020-07-466am.exe chulo.exe PID 1700 wrote to memory of 1856 1700 Q2020-07-466am.exe chulo.exe PID 1700 wrote to memory of 1856 1700 Q2020-07-466am.exe chulo.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe PID 1856 wrote to memory of 1512 1856 chulo.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q2020-07-466am.exe"C:\Users\Admin\AppData\Local\Temp\Q2020-07-466am.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v chulo /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\chulo.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v chulo /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\chulo.exe"3⤵
- Adds Run key to start application
PID:1812 -
C:\Users\Admin\AppData\Roaming\chulo.exe"C:\Users\Admin\AppData\Roaming\chulo.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1512
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Roaming\chulo.exeFilesize
1.4MB
MD593a02efc3319e40884d86f0603d6073d
SHA1df7966c6dda6c785ad4bcf5b7a49f0a99a9bc51e
SHA256de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78
SHA512620172b1822721b279eb1b92d288a2ee82056b77c91c59134edc1aa727524bee2e5211cc41d69e67b1dc1caf9c555e5f475b3fca97d3dd3b94b224443e5fc2c7
-
C:\Users\Admin\AppData\Roaming\chulo.exeFilesize
1.4MB
MD593a02efc3319e40884d86f0603d6073d
SHA1df7966c6dda6c785ad4bcf5b7a49f0a99a9bc51e
SHA256de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78
SHA512620172b1822721b279eb1b92d288a2ee82056b77c91c59134edc1aa727524bee2e5211cc41d69e67b1dc1caf9c555e5f475b3fca97d3dd3b94b224443e5fc2c7
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Roaming\chulo.exeFilesize
1.4MB
MD593a02efc3319e40884d86f0603d6073d
SHA1df7966c6dda6c785ad4bcf5b7a49f0a99a9bc51e
SHA256de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78
SHA512620172b1822721b279eb1b92d288a2ee82056b77c91c59134edc1aa727524bee2e5211cc41d69e67b1dc1caf9c555e5f475b3fca97d3dd3b94b224443e5fc2c7
-
memory/856-58-0x0000000000000000-mapping.dmp
-
memory/1512-85-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-113-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-596-0x0000000002185000-0x0000000002196000-memory.dmpFilesize
68KB
-
memory/1512-594-0x00000000003B0000-0x00000000003F4000-memory.dmpFilesize
272KB
-
memory/1512-131-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-129-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-72-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-127-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-74-0x00000000004ACB6E-mapping.dmp
-
memory/1512-77-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-79-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-81-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-83-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-125-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-87-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-89-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-91-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-93-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-95-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-97-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-99-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-101-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-103-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-105-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-107-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-109-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-111-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-123-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-115-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-117-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-119-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-121-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1700-54-0x0000000000F20000-0x0000000001086000-memory.dmpFilesize
1.4MB
-
memory/1700-55-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB
-
memory/1700-56-0x00000000004F0000-0x000000000050C000-memory.dmpFilesize
112KB
-
memory/1700-57-0x0000000000630000-0x000000000063A000-memory.dmpFilesize
40KB
-
memory/1812-59-0x0000000000000000-mapping.dmp
-
memory/1856-61-0x0000000000000000-mapping.dmp
-
memory/1856-64-0x00000000008F0000-0x0000000000A56000-memory.dmpFilesize
1.4MB