Analysis
- max time kernel
129s - max time network
172s - platform
windows7_x64 - resource
win7-20220414-en - submitted
21/05/2022, 01:44
General
- Target DHL AWB NO2. 405986998.exe
- Size 757KB
- Sample220521-b6bcwsdaf2
- SHA256 7cee0e7a663f8a865255723ea5fe89fac90be773094c04ad82b5aee132f50cd7
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.7.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 4:39:50 AM MassLogger Started: 5/21/2022 4:39:23 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL AWB NO2. 405986998.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 6 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB NO2. 405986998.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB NO2. 405986998.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\axQZqAONP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA44.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB NO2. 405986998.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmpAA44.tmp
memory/1628-54-0x00000000009D0000-0x0000000000A94000-memory.dmp
memory/1628-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmp
memory/1628-56-0x0000000000420000-0x0000000000428000-memory.dmp
memory/1628-57-0x0000000007FF0000-0x00000000080A0000-memory.dmp
memory/1752-61-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1752-63-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1752-60-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1752-64-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1752-65-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1752-68-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1752-70-0x0000000000400000-0x00000000004A8000-memory.dmp
memory/1752-71-0x00000000006D0000-0x0000000000714000-memory.dmp
memory/1752-73-0x0000000000735000-0x0000000000746000-memory.dmp
memory/1752-74-0x0000000002140000-0x0000000002154000-memory.dmp