Analysis

  • max time kernel
    170s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 02:41

General

  • Target

    INVOICE RD-65_xls.exe

  • Size

    836KB

  • MD5

    edd5bb0a52718d2cdb4eee1fbfdb33dc

  • SHA1

    fd4c476494adc0e34ef04183042744251d62e2eb

  • SHA256

    49ced6e317fa96af1310ad10e5b71fea0d84e03b42ff0434f11d312ebb62dbcf

  • SHA512

    14f31d689be224c715df871415561ff7191fdb4a3272612b9d7a307915f24e45644942b65c76a1c0184e6c4ba4cffd0d3721703023a1d867dac27f3474604465

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:05:36 AM MassLogger Started: 5/21/2022 6:05:08 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\INVOICE RD-65_xls.exe As Administrator: True

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    evra12345

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 32 IoCs
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICE RD-65_xls.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE RD-65_xls.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Users\Admin\AppData\Local\Temp\INVOICE RD-65_xls.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:868

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INVOICE RD-65_xls.exe.log

    Filesize

    507B

    MD5

    ab4c71d3ff6255edd4e5c1e09540f49e

    SHA1

    22e06bf4e258741b5df918061871cba998c50cea

    SHA256

    1690fec628f775dd3c3385b800eed126b37978ef2ffd592b024052724caafb5a

    SHA512

    8fa7d0045796e6cda7c28e2b9a690ef550619828c1b5d0ebf8e8367aff4bf4d9f63121e5b4f199d30cb8006eb584c6767f4c59150749b8256dab9dd0ebd9f1af

  • memory/868-165-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-195-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-638-0x0000000007680000-0x00000000076D0000-memory.dmp

    Filesize

    320KB

  • memory/868-134-0x0000000000000000-mapping.dmp

  • memory/868-135-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-137-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-163-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-141-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-143-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-145-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-147-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-149-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-151-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-153-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-155-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-157-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-159-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-167-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-139-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-637-0x0000000005D10000-0x0000000005D1A000-memory.dmp

    Filesize

    40KB

  • memory/868-161-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-169-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-171-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-173-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-175-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-177-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-179-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-181-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-183-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-185-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-187-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-189-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-191-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-193-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/868-636-0x0000000005A90000-0x0000000005AF6000-memory.dmp

    Filesize

    408KB

  • memory/868-197-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2660-130-0x0000000000760000-0x0000000000838000-memory.dmp

    Filesize

    864KB

  • memory/2660-132-0x0000000005320000-0x00000000053B2000-memory.dmp

    Filesize

    584KB

  • memory/2660-133-0x0000000007330000-0x00000000078D4000-memory.dmp

    Filesize

    5.6MB

  • memory/2660-131-0x00000000051E0000-0x000000000527C000-memory.dmp

    Filesize

    624KB