Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:41
Static task
static1
Behavioral task
behavioral1
Sample
Q2020-07-466am.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Q2020-07-466am.exe
Resource
win10v2004-20220414-en
General
-
Target
Q2020-07-466am.exe
-
Size
1.4MB
-
MD5
93a02efc3319e40884d86f0603d6073d
-
SHA1
df7966c6dda6c785ad4bcf5b7a49f0a99a9bc51e
-
SHA256
de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78
-
SHA512
620172b1822721b279eb1b92d288a2ee82056b77c91c59134edc1aa727524bee2e5211cc41d69e67b1dc1caf9c555e5f475b3fca97d3dd3b94b224443e5fc2c7
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\F293CD6622\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
y8wG[wgBvT]F
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 35 IoCs
Processes:
resource yara_rule behavioral2/memory/3824-130-0x0000000000F80000-0x00000000010E6000-memory.dmp family_masslogger C:\Users\Admin\AppData\Roaming\chulo.exe family_masslogger C:\Users\Admin\AppData\Roaming\chulo.exe family_masslogger behavioral2/memory/3440-139-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-143-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-145-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-147-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-149-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-151-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-153-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-155-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-157-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-159-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-161-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-163-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-165-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-167-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-169-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-171-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-173-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-175-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-179-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-177-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-181-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-183-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-185-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-187-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-189-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-191-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-193-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-195-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-197-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-199-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-201-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger behavioral2/memory/3440-203-0x0000000000400000-0x00000000004B2000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 2 IoCs
Processes:
chulo.exeInstallUtil.exepid process 1656 chulo.exe 3440 InstallUtil.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
InstallUtil.exeQ2020-07-466am.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation InstallUtil.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Q2020-07-466am.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
Processes:
InstallUtil.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chulo = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\chulo.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 42 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chulo.exedescription pid process target process PID 1656 set thread context of 3440 1656 chulo.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
InstallUtil.exepid process 3440 InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
Q2020-07-466am.exechulo.exeInstallUtil.exepid process 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 3824 Q2020-07-466am.exe 1656 chulo.exe 1656 chulo.exe 1656 chulo.exe 3440 InstallUtil.exe 3440 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Q2020-07-466am.exechulo.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3824 Q2020-07-466am.exe Token: SeDebugPrivilege 1656 chulo.exe Token: SeDebugPrivilege 3440 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 3440 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Q2020-07-466am.execmd.exechulo.exedescription pid process target process PID 3824 wrote to memory of 3540 3824 Q2020-07-466am.exe cmd.exe PID 3824 wrote to memory of 3540 3824 Q2020-07-466am.exe cmd.exe PID 3824 wrote to memory of 3540 3824 Q2020-07-466am.exe cmd.exe PID 3540 wrote to memory of 2656 3540 cmd.exe reg.exe PID 3540 wrote to memory of 2656 3540 cmd.exe reg.exe PID 3540 wrote to memory of 2656 3540 cmd.exe reg.exe PID 3824 wrote to memory of 1656 3824 Q2020-07-466am.exe chulo.exe PID 3824 wrote to memory of 1656 3824 Q2020-07-466am.exe chulo.exe PID 3824 wrote to memory of 1656 3824 Q2020-07-466am.exe chulo.exe PID 1656 wrote to memory of 3440 1656 chulo.exe InstallUtil.exe PID 1656 wrote to memory of 3440 1656 chulo.exe InstallUtil.exe PID 1656 wrote to memory of 3440 1656 chulo.exe InstallUtil.exe PID 1656 wrote to memory of 3440 1656 chulo.exe InstallUtil.exe PID 1656 wrote to memory of 3440 1656 chulo.exe InstallUtil.exe PID 1656 wrote to memory of 3440 1656 chulo.exe InstallUtil.exe PID 1656 wrote to memory of 3440 1656 chulo.exe InstallUtil.exe PID 1656 wrote to memory of 3440 1656 chulo.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q2020-07-466am.exe"C:\Users\Admin\AppData\Local\Temp\Q2020-07-466am.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v chulo /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\chulo.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v chulo /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\chulo.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\chulo.exe"C:\Users\Admin\AppData\Roaming\chulo.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Roaming\chulo.exeFilesize
1.4MB
MD593a02efc3319e40884d86f0603d6073d
SHA1df7966c6dda6c785ad4bcf5b7a49f0a99a9bc51e
SHA256de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78
SHA512620172b1822721b279eb1b92d288a2ee82056b77c91c59134edc1aa727524bee2e5211cc41d69e67b1dc1caf9c555e5f475b3fca97d3dd3b94b224443e5fc2c7
-
C:\Users\Admin\AppData\Roaming\chulo.exeFilesize
1.4MB
MD593a02efc3319e40884d86f0603d6073d
SHA1df7966c6dda6c785ad4bcf5b7a49f0a99a9bc51e
SHA256de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78
SHA512620172b1822721b279eb1b92d288a2ee82056b77c91c59134edc1aa727524bee2e5211cc41d69e67b1dc1caf9c555e5f475b3fca97d3dd3b94b224443e5fc2c7
-
memory/1656-135-0x0000000000000000-mapping.dmp
-
memory/2656-134-0x0000000000000000-mapping.dmp
-
memory/3440-163-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-173-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-138-0x0000000000000000-mapping.dmp
-
memory/3440-139-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-659-0x0000000007BA0000-0x0000000007BF0000-memory.dmpFilesize
320KB
-
memory/3440-658-0x00000000070E0000-0x00000000070EA000-memory.dmpFilesize
40KB
-
memory/3440-143-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-145-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-147-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-149-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-151-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-153-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-155-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-157-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-159-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-161-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-657-0x0000000005AC0000-0x0000000005B26000-memory.dmpFilesize
408KB
-
memory/3440-165-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-167-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-169-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-171-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-656-0x0000000005650000-0x00000000056EC000-memory.dmpFilesize
624KB
-
memory/3440-175-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-179-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-177-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-181-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-183-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-185-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-187-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-189-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-191-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-193-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-195-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-197-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-199-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-201-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3440-203-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3540-133-0x0000000000000000-mapping.dmp
-
memory/3824-130-0x0000000000F80000-0x00000000010E6000-memory.dmpFilesize
1.4MB
-
memory/3824-131-0x0000000006730000-0x0000000006CD4000-memory.dmpFilesize
5.6MB
-
memory/3824-132-0x0000000006280000-0x0000000006312000-memory.dmpFilesize
584KB