Analysis

  • max time kernel
    59s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 03:34

General

  • Target

    NEW ORDER .exe

  • Size

    709KB

  • MD5

    e6f2ef791f0ec1869a975fa14248e8a1

  • SHA1

    bca1cf7d10b095100273065d9e59fd1107afd353

  • SHA256

    c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

  • SHA512

    247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:19:08 AM MassLogger Started: 5/21/2022 5:18:57 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe As Administrator: True

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 5:19:08 AM MassLogger Started: 5/21/2022 5:18:57 AM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe As Administrator: True ### WD Exclusion ### Disabled

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger log file 2 IoCs

    Detects a log file produced by MassLogger.

  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Executes dropped EXE 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe
    "C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IapdeqiYxjrvsQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC70.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1120
    • C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe
      "C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"
      2⤵
        PID:1748
      • C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe
        "C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"
        2⤵
          PID:1484
        • C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe
          "C:\Users\Admin\AppData\Local\Temp\NEW ORDER .exe"
          2⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn vlc.exe /tr '"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"' & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1628
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn vlc.exe /tr '"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"'
              4⤵
              • Creates scheduled task(s)
              PID:1668
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC39E.tmp.bat""
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:800
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              4⤵
              • Delays execution with timeout.exe
              PID:1028
            • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
              "C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1616
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IapdeqiYxjrvsQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6FF.tmp"
                5⤵
                • Creates scheduled task(s)
                PID:1504
              • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
                "C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"
                5⤵
                • Executes dropped EXE
                PID:1608
              • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
                "C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"
                5⤵
                • Executes dropped EXE
                PID:1992
              • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
                "C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"
                5⤵
                • Executes dropped EXE
                PID:1536
              • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
                "C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1524
              • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
                "C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"
                5⤵
                • Executes dropped EXE
                PID:1568

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt
        Filesize

        619B

        MD5

        dd4c9d18d412811d8c0da01d6b465703

        SHA1

        061cf7b8dcb6b0be2834c5795b2f5ec917791380

        SHA256

        5532fc69b2753a1a303a55945098f139570da207b7230857efa994f3759b3bc5

        SHA512

        bb6ff296e0893237b8ab92bec484e0f35956d0b45c7ef7fc2827e054ebf3763278d57e51d0190df61ba97ffbe08f7d26b8ec6aff0ec9eaee7008fb45b3cba5a6

      • C:\Users\Admin\AppData\Local\Temp\tmpC39E.tmp.bat
        Filesize

        156B

        MD5

        c0129017e1f1dfd85de7e6fc11e8adc1

        SHA1

        b0a1b7edec8a5e7d2b47bf5e03cd67e62b8d70fe

        SHA256

        9b76f48a22b668bcbf36feb67bafa528009b3ff87d73b65d2a9fa42c47715762

        SHA512

        6b54f426fa7035703bfbc5fad3bef6f5df1729edfe2e8e713d77a45d7a274c0287ce1bbc74a5f68737c7dcfb9d9153b071e45b722d2bdb72046b3cacd9659622

      • C:\Users\Admin\AppData\Local\Temp\tmpC70.tmp
        Filesize

        1KB

        MD5

        ac6d80bf25675aefd5cc746dfbf63b04

        SHA1

        421facc246f710e1e0abc25c8f8f518890d149d6

        SHA256

        f580a5f04654984fd80701c64fd2339547db3f7b6fc4abafae20961c80921680

        SHA512

        1268c557f06e7b5b76cc0c94efdd88d342fa9f07edd94a6f691974dc58c69d1456baa255263ca57c95a370d9ae5274541c730140d83402f5b1d6fc1d0aea5602

      • C:\Users\Admin\AppData\Local\Temp\tmpD6FF.tmp
        Filesize

        1KB

        MD5

        ac6d80bf25675aefd5cc746dfbf63b04

        SHA1

        421facc246f710e1e0abc25c8f8f518890d149d6

        SHA256

        f580a5f04654984fd80701c64fd2339547db3f7b6fc4abafae20961c80921680

        SHA512

        1268c557f06e7b5b76cc0c94efdd88d342fa9f07edd94a6f691974dc58c69d1456baa255263ca57c95a370d9ae5274541c730140d83402f5b1d6fc1d0aea5602

      • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
        Filesize

        709KB

        MD5

        e6f2ef791f0ec1869a975fa14248e8a1

        SHA1

        bca1cf7d10b095100273065d9e59fd1107afd353

        SHA256

        c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

        SHA512

        247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

      • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
        Filesize

        709KB

        MD5

        e6f2ef791f0ec1869a975fa14248e8a1

        SHA1

        bca1cf7d10b095100273065d9e59fd1107afd353

        SHA256

        c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

        SHA512

        247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

      • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
        Filesize

        709KB

        MD5

        e6f2ef791f0ec1869a975fa14248e8a1

        SHA1

        bca1cf7d10b095100273065d9e59fd1107afd353

        SHA256

        c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

        SHA512

        247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

      • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
        Filesize

        709KB

        MD5

        e6f2ef791f0ec1869a975fa14248e8a1

        SHA1

        bca1cf7d10b095100273065d9e59fd1107afd353

        SHA256

        c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

        SHA512

        247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

      • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
        Filesize

        709KB

        MD5

        e6f2ef791f0ec1869a975fa14248e8a1

        SHA1

        bca1cf7d10b095100273065d9e59fd1107afd353

        SHA256

        c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

        SHA512

        247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

      • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
        Filesize

        709KB

        MD5

        e6f2ef791f0ec1869a975fa14248e8a1

        SHA1

        bca1cf7d10b095100273065d9e59fd1107afd353

        SHA256

        c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

        SHA512

        247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

      • C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
        Filesize

        709KB

        MD5

        e6f2ef791f0ec1869a975fa14248e8a1

        SHA1

        bca1cf7d10b095100273065d9e59fd1107afd353

        SHA256

        c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

        SHA512

        247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

      • \Users\Admin\AppData\Roaming\VideoLAN\vlc.exe
        Filesize

        709KB

        MD5

        e6f2ef791f0ec1869a975fa14248e8a1

        SHA1

        bca1cf7d10b095100273065d9e59fd1107afd353

        SHA256

        c77b479ead371d060f45186dc10d6bb2c9d32aac0275de27fab94b2f65a54500

        SHA512

        247b507bb4073e1a89f7078812ab993831923691cf6b40962b0685d96205281472f183b00ce122cd59a979fb3b45152a2a5bdb168de9d368ba2c1994c32a082b

      • memory/800-573-0x0000000000000000-mapping.dmp
      • memory/1028-576-0x0000000000000000-mapping.dmp
      • memory/1120-58-0x0000000000000000-mapping.dmp
      • memory/1504-583-0x0000000000000000-mapping.dmp
      • memory/1524-595-0x00000000004A1A5E-mapping.dmp
      • memory/1524-601-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1616-581-0x0000000000260000-0x0000000000318000-memory.dmp
        Filesize

        736KB

      • memory/1616-579-0x0000000000000000-mapping.dmp
      • memory/1628-572-0x0000000000000000-mapping.dmp
      • memory/1668-574-0x0000000000000000-mapping.dmp
      • memory/1732-74-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-86-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-92-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-94-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-96-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-98-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-100-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-102-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-104-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-108-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-106-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-110-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-112-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-114-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-116-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-118-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-120-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-122-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-88-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-90-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-84-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-82-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-80-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-78-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-76-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-60-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-72-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-70-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-68-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-66-0x00000000004A1A5E-mapping.dmp
      • memory/1732-65-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-64-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-63-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1732-61-0x0000000000400000-0x00000000004A6000-memory.dmp
        Filesize

        664KB

      • memory/1980-54-0x00000000002B0000-0x0000000000368000-memory.dmp
        Filesize

        736KB

      • memory/1980-57-0x0000000005170000-0x000000000521E000-memory.dmp
        Filesize

        696KB

      • memory/1980-56-0x00000000002A0000-0x00000000002A8000-memory.dmp
        Filesize

        32KB

      • memory/1980-55-0x00000000768D1000-0x00000000768D3000-memory.dmp
        Filesize

        8KB