Overview

overview

10

Static

static

NEW ORDER .exe

windows7_x64

10

NEW ORDER .exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0410a74a0b1bd7b7a626e2c1efb3c7e91c6f0571a42dd447c86a4afe382ba18b

  • Size

    691KB

  • Sample

    220521-d47pesgha6

  • MD5

    2295ecc808e38d883567b57866e035a6

  • SHA1

    5f45aa3a51b064071cbfff54c6fdc1beaf9f3507

  • SHA256

    0410a74a0b1bd7b7a626e2c1efb3c7e91c6f0571a42dd447c86a4afe382ba18b

  • SHA512

    d6f2e7d1d255a639c241c6146cefcb181b5afbbd55e5cdefeff778bf021ff19755d58f039877248e1c6785ebf931be55787965be8579e4e72362e3546276d1a6

Score
10/10
massloggercollectionransomwarerezer0spywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:19:08 AM MassLogger Started: 5/21/2022 5:18:57 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe As Administrator: True

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:19:08 AM MassLogger Started: 5/21/2022 5:18:57 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe As Administrator: True ### WD Exclusion ### Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\19E979543A\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 7:19:09 AM MassLogger Started: 5/21/2022 7:19:05 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe As Administrator: True

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\19E979543A\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 7:19:37 AM MassLogger Started: 5/21/2022 7:19:34 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe As Administrator: True

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    billions@cairoways.me
  • Password:
    Whyworry90#

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\19E979543A\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 7:19:09 AM MassLogger Started: 5/21/2022 7:19:05 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe As Administrator: True ### WD Exclusion ### Disabled

Targets

    • Target

      NEW ORDER .exe

    • Size

      709KB

    • MD5

      e6f2ef791f0ec1869a975fa14248e8a1

    • SHA1

      bca1cf7d10b095100273065d9e59fd1107afd353

    • SHA256

      c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

    • SHA512

      247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

    Score
    10/10
    massloggerransomwarerezer0spywarestealercollection

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks