Analysis
-
max time kernel
95s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:52
Static task
static1
Behavioral task
behavioral1
Sample
SCTB38 NEW782.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SCTB38 NEW782.exe
Resource
win10v2004-20220414-en
General
-
Target
SCTB38 NEW782.exe
-
Size
1.0MB
-
MD5
18b6f9b159d93570f9ace705a62a9fad
-
SHA1
82f75eeef6e25500f517faf6f561057e63ea3a63
-
SHA256
48c124e7d628adaa322470af51fdee8a965faf61bdfbc4c2b143dcf57d52be1a
-
SHA512
d836b883425d6c8567eb0876a67525aca3ac6a33c0b7d2a72ef76bf6f0bf71594fdb2c71d6b18f5eeb607c1b3cd334876ae5d2906fa456d6b8d2c6e498696e39
Malware Config
Extracted
C:\Users\Admin\AppData\Local\0F48153F20\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
masslog1960
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 2 IoCs
Processes:
vlc.exevlc.exepid process 2216 vlc.exe 2556 vlc.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SCTB38 NEW782.exevlc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation SCTB38 NEW782.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation vlc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
vlc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vlc.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook vlc.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook vlc.exe Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 30 api.ipify.org 47 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SCTB38 NEW782.exevlc.exedescription pid process target process PID 2160 set thread context of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 2216 set thread context of 2556 2216 vlc.exe vlc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1960 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2556 vlc.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
SCTB38 NEW782.exeSCTB38 NEW782.exevlc.exevlc.exepid process 2160 SCTB38 NEW782.exe 2160 SCTB38 NEW782.exe 2160 SCTB38 NEW782.exe 2160 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 3992 SCTB38 NEW782.exe 2216 vlc.exe 2216 vlc.exe 2216 vlc.exe 2556 vlc.exe 2556 vlc.exe 2556 vlc.exe 2556 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SCTB38 NEW782.exeSCTB38 NEW782.exevlc.exevlc.exedescription pid process Token: SeDebugPrivilege 2160 SCTB38 NEW782.exe Token: SeDebugPrivilege 3992 SCTB38 NEW782.exe Token: SeDebugPrivilege 2216 vlc.exe Token: SeDebugPrivilege 2556 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2556 vlc.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
SCTB38 NEW782.exeSCTB38 NEW782.execmd.execmd.exevlc.exedescription pid process target process PID 2160 wrote to memory of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 2160 wrote to memory of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 2160 wrote to memory of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 2160 wrote to memory of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 2160 wrote to memory of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 2160 wrote to memory of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 2160 wrote to memory of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 2160 wrote to memory of 3992 2160 SCTB38 NEW782.exe SCTB38 NEW782.exe PID 3992 wrote to memory of 1388 3992 SCTB38 NEW782.exe cmd.exe PID 3992 wrote to memory of 1388 3992 SCTB38 NEW782.exe cmd.exe PID 3992 wrote to memory of 1388 3992 SCTB38 NEW782.exe cmd.exe PID 3992 wrote to memory of 4540 3992 SCTB38 NEW782.exe cmd.exe PID 3992 wrote to memory of 4540 3992 SCTB38 NEW782.exe cmd.exe PID 3992 wrote to memory of 4540 3992 SCTB38 NEW782.exe cmd.exe PID 1388 wrote to memory of 4532 1388 cmd.exe schtasks.exe PID 1388 wrote to memory of 4532 1388 cmd.exe schtasks.exe PID 1388 wrote to memory of 4532 1388 cmd.exe schtasks.exe PID 4540 wrote to memory of 1960 4540 cmd.exe timeout.exe PID 4540 wrote to memory of 1960 4540 cmd.exe timeout.exe PID 4540 wrote to memory of 1960 4540 cmd.exe timeout.exe PID 4540 wrote to memory of 2216 4540 cmd.exe vlc.exe PID 4540 wrote to memory of 2216 4540 cmd.exe vlc.exe PID 4540 wrote to memory of 2216 4540 cmd.exe vlc.exe PID 2216 wrote to memory of 2556 2216 vlc.exe vlc.exe PID 2216 wrote to memory of 2556 2216 vlc.exe vlc.exe PID 2216 wrote to memory of 2556 2216 vlc.exe vlc.exe PID 2216 wrote to memory of 2556 2216 vlc.exe vlc.exe PID 2216 wrote to memory of 2556 2216 vlc.exe vlc.exe PID 2216 wrote to memory of 2556 2216 vlc.exe vlc.exe PID 2216 wrote to memory of 2556 2216 vlc.exe vlc.exe PID 2216 wrote to memory of 2556 2216 vlc.exe vlc.exe -
outlook_office_path 1 IoCs
Processes:
vlc.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe -
outlook_win_path 1 IoCs
Processes:
vlc.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCTB38 NEW782.exe"C:\Users\Admin\AppData\Local\Temp\SCTB38 NEW782.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\SCTB38 NEW782.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn vlc.exe /tr '"C:\Users\Admin\VideoLAN\vlc.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn vlc.exe /tr '"C:\Users\Admin\VideoLAN\vlc.exe"'4⤵
- Creates scheduled task(s)
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8A3E.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:1960 -
C:\Users\Admin\VideoLAN\vlc.exe"C:\Users\Admin\VideoLAN\vlc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\VideoLAN\vlc.exe"{path}"5⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2556
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56dcfdb496c3cf0a736b09292618b380d
SHA159d3aecbd319c9b48d500b51a093ee48d02af334
SHA256cb5dcf594045c8b7a5f87e8a12eabbd3e53e673654926027627ed79ef3e2a203
SHA5129b7d22dc9e40d11693f7191f7b075a78974322af145010e66b19d989e678477dfe4741e88d02929d5b37236276f4605bc23a7adbedf43b66cd3c4e5e7b7e67ff
-
Filesize
1KB
MD56dcfdb496c3cf0a736b09292618b380d
SHA159d3aecbd319c9b48d500b51a093ee48d02af334
SHA256cb5dcf594045c8b7a5f87e8a12eabbd3e53e673654926027627ed79ef3e2a203
SHA5129b7d22dc9e40d11693f7191f7b075a78974322af145010e66b19d989e678477dfe4741e88d02929d5b37236276f4605bc23a7adbedf43b66cd3c4e5e7b7e67ff
-
Filesize
140B
MD573f6a2b0972fe2524ef6a6f09b6c789c
SHA1b324258e3993fbba182e0f6dbf1e895d5cd6cf4b
SHA2566dd62db1905607640852050055e6b3f5210bb5434a178fbfd70f2a0bb9cd7aaa
SHA5123edf4117a599b5c89a11f7075f97db57f1f72866c2a6fd81b2441c03234fffdd8cac2e5310b5b76ee9e181a45eb1416ea4aa9329ea07bc41e6cc6be6c7c8b0fe
-
Filesize
1.0MB
MD518b6f9b159d93570f9ace705a62a9fad
SHA182f75eeef6e25500f517faf6f561057e63ea3a63
SHA25648c124e7d628adaa322470af51fdee8a965faf61bdfbc4c2b143dcf57d52be1a
SHA512d836b883425d6c8567eb0876a67525aca3ac6a33c0b7d2a72ef76bf6f0bf71594fdb2c71d6b18f5eeb607c1b3cd334876ae5d2906fa456d6b8d2c6e498696e39
-
Filesize
1.0MB
MD518b6f9b159d93570f9ace705a62a9fad
SHA182f75eeef6e25500f517faf6f561057e63ea3a63
SHA25648c124e7d628adaa322470af51fdee8a965faf61bdfbc4c2b143dcf57d52be1a
SHA512d836b883425d6c8567eb0876a67525aca3ac6a33c0b7d2a72ef76bf6f0bf71594fdb2c71d6b18f5eeb607c1b3cd334876ae5d2906fa456d6b8d2c6e498696e39
-
Filesize
1.0MB
MD518b6f9b159d93570f9ace705a62a9fad
SHA182f75eeef6e25500f517faf6f561057e63ea3a63
SHA25648c124e7d628adaa322470af51fdee8a965faf61bdfbc4c2b143dcf57d52be1a
SHA512d836b883425d6c8567eb0876a67525aca3ac6a33c0b7d2a72ef76bf6f0bf71594fdb2c71d6b18f5eeb607c1b3cd334876ae5d2906fa456d6b8d2c6e498696e39