Analysis
-
max time kernel
79s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:43
Static task
static1
Behavioral task
behavioral1
Sample
Order Items For Quote.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order Items For Quote.exe
Resource
win10v2004-20220414-en
General
-
Target
Order Items For Quote.exe
-
Size
1.4MB
-
MD5
21a228a97e5cf4151c2d9c30b5881af4
-
SHA1
209c462e664c6ed80c84a611d5a8b1f7534c5b19
-
SHA256
7391f3917523baee91e92967c12e20c57448474696590fcbc6e5e6b3c5e21f78
-
SHA512
90b59ab03824c70003c369b259b08c8ca748d864eb35c2ad6f877115cef3772423fd6da5d59fc793299f775087acce8fe431d318f20d83b23162144dfadab4db
Malware Config
Extracted
C:\Users\Admin\AppData\Local\3B8E3C2477\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1136-62-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger behavioral1/memory/1136-63-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger behavioral1/memory/1136-64-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger behavioral1/memory/1136-65-0x00000000004B34AE-mapping.dmp family_masslogger behavioral1/memory/1136-67-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger behavioral1/memory/1136-69-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order Items For Quote.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation Order Items For Quote.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
Order Items For Quote.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Order Items For Quote.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Order Items For Quote.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order Items For Quote.exedescription pid process target process PID 960 set thread context of 1136 960 Order Items For Quote.exe Order Items For Quote.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Order Items For Quote.exepid process 1136 Order Items For Quote.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Order Items For Quote.exepid process 1136 Order Items For Quote.exe 1136 Order Items For Quote.exe 1136 Order Items For Quote.exe 1136 Order Items For Quote.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Order Items For Quote.exedescription pid process Token: SeDebugPrivilege 1136 Order Items For Quote.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Order Items For Quote.exepid process 1136 Order Items For Quote.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Order Items For Quote.exedescription pid process target process PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe PID 960 wrote to memory of 1136 960 Order Items For Quote.exe Order Items For Quote.exe -
outlook_office_path 1 IoCs
Processes:
Order Items For Quote.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe -
outlook_win_path 1 IoCs
Processes:
Order Items For Quote.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order Items For Quote.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Items For Quote.exe"C:\Users\Admin\AppData\Local\Temp\Order Items For Quote.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Items For Quote.exe"C:\Users\Admin\AppData\Local\Temp\Order Items For Quote.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/960-54-0x0000000000FD0000-0x0000000001136000-memory.dmpFilesize
1.4MB
-
memory/960-55-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/960-56-0x00000000003E0000-0x00000000003F0000-memory.dmpFilesize
64KB
-
memory/960-57-0x0000000005760000-0x0000000005858000-memory.dmpFilesize
992KB
-
memory/960-58-0x0000000005850000-0x0000000005918000-memory.dmpFilesize
800KB
-
memory/1136-59-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1136-60-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1136-62-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1136-63-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1136-64-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1136-65-0x00000000004B34AE-mapping.dmp
-
memory/1136-67-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1136-69-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1136-70-0x0000000000BD0000-0x0000000000C48000-memory.dmpFilesize
480KB
-
memory/1136-72-0x0000000004B05000-0x0000000004B16000-memory.dmpFilesize
68KB