Analysis
-
max time kernel
74s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quotation - 808923AC.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Request For Quotation - 808923AC.exe
Resource
win10v2004-20220414-en
General
-
Target
Request For Quotation - 808923AC.exe
-
Size
1.1MB
-
MD5
77d3a40e32e4c9cc91d2084d6b5f348a
-
SHA1
6db4d154a11866ba7f603248157f5f533e6ab716
-
SHA256
0f827a522bec00f64e7c734f68677414a25c732f83e7c9def21299a0d8a0f8c4
-
SHA512
d677fbd3bab91fbe35f47e38b797182ef8c4cd869a3beb97bfe15b95a6556c887d25f6d6e87d9f3f60daf8735894ec83043d846a98eb73cdadee2a4daea8f69d
Malware Config
Extracted
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Request For Quotation - 808923AC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation Request For Quotation - 808923AC.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
Request For Quotation - 808923AC.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook Request For Quotation - 808923AC.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Request For Quotation - 808923AC.exedescription pid process target process PID 1156 set thread context of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Request For Quotation - 808923AC.exeRequest For Quotation - 808923AC.exepid process 1156 Request For Quotation - 808923AC.exe 1156 Request For Quotation - 808923AC.exe 1156 Request For Quotation - 808923AC.exe 1616 Request For Quotation - 808923AC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Request For Quotation - 808923AC.exeRequest For Quotation - 808923AC.exedescription pid process Token: SeDebugPrivilege 1156 Request For Quotation - 808923AC.exe Token: SeDebugPrivilege 1616 Request For Quotation - 808923AC.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
Request For Quotation - 808923AC.exedescription pid process target process PID 1156 wrote to memory of 1604 1156 Request For Quotation - 808923AC.exe schtasks.exe PID 1156 wrote to memory of 1604 1156 Request For Quotation - 808923AC.exe schtasks.exe PID 1156 wrote to memory of 1604 1156 Request For Quotation - 808923AC.exe schtasks.exe PID 1156 wrote to memory of 1604 1156 Request For Quotation - 808923AC.exe schtasks.exe PID 1156 wrote to memory of 1640 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1640 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1640 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1640 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1660 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1660 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1660 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1660 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1696 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1696 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1696 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1696 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe PID 1156 wrote to memory of 1616 1156 Request For Quotation - 808923AC.exe Request For Quotation - 808923AC.exe -
outlook_office_path 1 IoCs
Processes:
Request For Quotation - 808923AC.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe -
outlook_win_path 1 IoCs
Processes:
Request For Quotation - 808923AC.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Request For Quotation - 808923AC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request For Quotation - 808923AC.exe"C:\Users\Admin\AppData\Local\Temp\Request For Quotation - 808923AC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TTNkEUoh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC360.tmp"2⤵
- Creates scheduled task(s)
PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\Request For Quotation - 808923AC.exe"{path}"2⤵PID:1640
-
-
C:\Users\Admin\AppData\Local\Temp\Request For Quotation - 808923AC.exe"{path}"2⤵PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\Request For Quotation - 808923AC.exe"{path}"2⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\Request For Quotation - 808923AC.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1616
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD558c98d68b1285ea29efe84833bdcd039
SHA16f41b68abfe4f2c3c56af426ab2babca9a56aa99
SHA2560e99e8f57a1ca0580f82dadedc7c5a446cb9c65d9ecd4adcc06456a3cfe3735e
SHA512649bd64c123a07caba7bb3793e299bfe91fc5a338bf816b5c8038969ece8d5043d8ce14310611a47e853b384448202d6b073111f4521a22fb2b58ede8739f3cd