Analysis
-
max time kernel
170s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:35
Static task
static1
Behavioral task
behavioral1
Sample
mpUN2haQz3Hh396.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
mpUN2haQz3Hh396.exe
Resource
win10v2004-20220414-en
General
-
Target
mpUN2haQz3Hh396.exe
-
Size
872KB
-
MD5
b616ebc834b650fee67ce3e99095dc6f
-
SHA1
c59a55cfb577b14589024ac0a34edcdb39d02c74
-
SHA256
f058f245d06f4d059132d2b9e90f84a332d0471ff0c421d49ca828d76874b8f3
-
SHA512
9b971064e009f3c52da0998fc31956bd3b156bb0a69447a1ef4960e54b4b145d8104b88b18b8a72a65b66cbd59445ec9210439e9b41a25b9cd919d15b9c11ee7
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mpUN2haQz3Hh396.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mpUN2haQz3Hh396.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mpUN2haQz3Hh396.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mpUN2haQz3Hh396.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation mpUN2haQz3Hh396.exe -
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
Processes:
mpUN2haQz3Hh396.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook mpUN2haQz3Hh396.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook mpUN2haQz3Hh396.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook mpUN2haQz3Hh396.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook mpUN2haQz3Hh396.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 58 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
mpUN2haQz3Hh396.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum mpUN2haQz3Hh396.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 mpUN2haQz3Hh396.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mpUN2haQz3Hh396.exedescription pid process target process PID 1156 set thread context of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
mpUN2haQz3Hh396.exepid process 4356 mpUN2haQz3Hh396.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
mpUN2haQz3Hh396.exepid process 4356 mpUN2haQz3Hh396.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mpUN2haQz3Hh396.exedescription pid process Token: SeDebugPrivilege 4356 mpUN2haQz3Hh396.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mpUN2haQz3Hh396.exepid process 4356 mpUN2haQz3Hh396.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
mpUN2haQz3Hh396.exedescription pid process target process PID 1156 wrote to memory of 3636 1156 mpUN2haQz3Hh396.exe schtasks.exe PID 1156 wrote to memory of 3636 1156 mpUN2haQz3Hh396.exe schtasks.exe PID 1156 wrote to memory of 3636 1156 mpUN2haQz3Hh396.exe schtasks.exe PID 1156 wrote to memory of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe PID 1156 wrote to memory of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe PID 1156 wrote to memory of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe PID 1156 wrote to memory of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe PID 1156 wrote to memory of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe PID 1156 wrote to memory of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe PID 1156 wrote to memory of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe PID 1156 wrote to memory of 4356 1156 mpUN2haQz3Hh396.exe mpUN2haQz3Hh396.exe -
outlook_office_path 1 IoCs
Processes:
mpUN2haQz3Hh396.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe -
outlook_win_path 1 IoCs
Processes:
mpUN2haQz3Hh396.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mpUN2haQz3Hh396.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mpUN2haQz3Hh396.exe"C:\Users\Admin\AppData\Local\Temp\mpUN2haQz3Hh396.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PdNcIoxjxwGkp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5A07.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\mpUN2haQz3Hh396.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mpUN2haQz3Hh396.exe.logFilesize
1KB
MD5e08f822522c617a40840c62e4b0fb45e
SHA1ae516dca4da5234be6676d3f234c19ec55725be7
SHA256bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
SHA512894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
-
C:\Users\Admin\AppData\Local\Temp\tmp5A07.tmpFilesize
1KB
MD502160e3d11550b31ba7eaa8ba8f08673
SHA1eb042ecf25c5270e0c8e599cf36ca74cd86e75ea
SHA2569612bb260184dbf2b33069f243e6cff6193e40508972eaad7114c5b51c15519e
SHA5124fe2013270cd75ec4b44f1e504483fbfd7380e3ced4bc7a62d42f8db4b074d936260757bacce4f254903c3bbac3fdbd1aab777159d8e26ca3a4b40c64252e69b
-
memory/1156-131-0x00000000059D0000-0x0000000005F74000-memory.dmpFilesize
5.6MB
-
memory/1156-132-0x0000000005420000-0x00000000054B2000-memory.dmpFilesize
584KB
-
memory/1156-133-0x00000000053F0000-0x00000000053FA000-memory.dmpFilesize
40KB
-
memory/1156-134-0x0000000009040000-0x00000000090DC000-memory.dmpFilesize
624KB
-
memory/1156-135-0x0000000008D80000-0x0000000008DE6000-memory.dmpFilesize
408KB
-
memory/1156-130-0x0000000000970000-0x0000000000A50000-memory.dmpFilesize
896KB
-
memory/3636-136-0x0000000000000000-mapping.dmp
-
memory/4356-160-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-172-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-142-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-144-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-146-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-148-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-150-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-152-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-154-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-156-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-158-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-138-0x0000000000000000-mapping.dmp
-
memory/4356-162-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-164-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-166-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-168-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-170-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-139-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-174-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-176-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-178-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-180-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-182-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-184-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-186-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-188-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-190-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-192-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-194-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-196-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-198-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-200-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-202-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4356-639-0x0000000007EB0000-0x0000000007F00000-memory.dmpFilesize
320KB