Overview

overview

10

Static

static

Purchase o...df.exe

windows7_x64

10

Purchase o...df.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 01:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Purchase order from Innovix Distribution_pdf.exe

  • Size

    1.0MB

  • MD5

    c55134b50627719ad8526757721e3146

  • SHA1

    a0e184e3f49bc7ea55d19b3ad698cb12fe05f517

  • SHA256

    e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b

  • SHA512

    6f56cc73cbada96b8e47c20d980ba25651951b80476b42250531e8d5cdfb0dffed5573d0f11693125d621dee46d5843dfc7c85c06d90536b581dfb033ea40e50

Score
10/10
massloggercollectionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\19E979543A\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 4:48:47 AM MassLogger Started: 5/21/2022 4:48:22 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.mytravelexplorer.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    e@sQ@,t?fK%&

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main Payload 1 IoCs
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FFFPxKmadUHiH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4253.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4516
    • C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe"
      2⤵
        PID:548
      • C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe"
        2⤵
          PID:4756
        • C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe"
          2⤵
            PID:400
          • C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\Purchase order from Innovix Distribution_pdf.exe"
            2⤵
            • Checks computer location settings
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • outlook_office_path
            • outlook_win_path
            PID:4792

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Email Collection

        1
        T1114

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp4253.tmp
          Filesize

          1KB

          MD5

          98771c98fc7f13c9b6d56e944a973dc8

          SHA1

          87c61911345b5065052c222717cd3fc179adec11

          SHA256

          a5b0b4bc0cec3323ad6d10880b81c040953b7fedac5332fd9a80ebd7706f6156

          SHA512

          c3a419866e1b201c6aa8b66a37944f037203970578d5abef221ace9bb345ba51143b900c9d392669795b17a8ceeaf340d10298b793a9dabb20669fc0ee030848

          Download Submit
        • memory/400-139-0x0000000000000000-mapping.dmp
          Download
        • memory/548-137-0x0000000000000000-mapping.dmp
          Download
        • memory/3996-132-0x0000000004E60000-0x0000000004EF2000-memory.dmp
          Filesize

          584KB

          Download
        • memory/3996-133-0x0000000004DD0000-0x0000000004DDA000-memory.dmp
          Filesize

          40KB

          Download
        • memory/3996-134-0x0000000008AB0000-0x0000000008B4C000-memory.dmp
          Filesize

          624KB

          Download
        • memory/3996-131-0x0000000005410000-0x00000000059B4000-memory.dmp
          Filesize

          5.6MB

          Download
        • memory/3996-130-0x0000000000310000-0x0000000000422000-memory.dmp
          Filesize

          1.1MB

          Download
        • memory/4516-135-0x0000000000000000-mapping.dmp
          Download
        • memory/4756-138-0x0000000000000000-mapping.dmp
          Download
        • memory/4792-140-0x0000000000000000-mapping.dmp
          Download
        • memory/4792-141-0x0000000000400000-0x00000000004A8000-memory.dmp
          Filesize

          672KB

          Download
        • memory/4792-142-0x0000000005A30000-0x0000000005A96000-memory.dmp
          Filesize

          408KB

          Download
        • memory/4792-143-0x0000000008770000-0x00000000087C0000-memory.dmp
          Filesize

          320KB

          Download