Analysis

  • max time kernel
    130s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 03:23

General

  • Target

    RFQ_873821.exe

  • Size

    836KB

  • MD5

    6cda2a931321f1fcdc0092a95d7c2b8a

  • SHA1

    4a1202631f6607e29f076b8d277f7101909c7a84

  • SHA256

    2b98c280d6a4bc8ab900831de9e049ed26f9db9ede66d0804b6581c8075ea1ee

  • SHA512

    3992f791bc8490cec3e7bfccdb9095367a54f2040e09efcdc6a6f1bbc2c33bb309b9a89b3379a5f53d74b9d81bc6f88f000268b6621ca5323b6f50afb1387e0c

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\19E979543A\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 7:02:25 AM MassLogger Started: 5/21/2022 7:02:11 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RFQ_873821.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ_873821.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ_873821.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fRaDghVtXh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp35A1.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2088
    • C:\Users\Admin\AppData\Local\Temp\RFQ_873821.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1812

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ_873821.exe.log

    Filesize

    507B

    MD5

    ab4c71d3ff6255edd4e5c1e09540f49e

    SHA1

    22e06bf4e258741b5df918061871cba998c50cea

    SHA256

    1690fec628f775dd3c3385b800eed126b37978ef2ffd592b024052724caafb5a

    SHA512

    8fa7d0045796e6cda7c28e2b9a690ef550619828c1b5d0ebf8e8367aff4bf4d9f63121e5b4f199d30cb8006eb584c6767f4c59150749b8256dab9dd0ebd9f1af

  • C:\Users\Admin\AppData\Local\Temp\tmp35A1.tmp

    Filesize

    1KB

    MD5

    4d2d8f20e988d6376178f44dad24f61a

    SHA1

    efd9abf78c2c5d3e36260a1dd36421afd5e4c26c

    SHA256

    cee42aa1e08eac8a789c1a3baf403f890dabb7c5c90a34b3cc2be6f794cf7de8

    SHA512

    00f3dc3420e9389ab9b0dc272ee74361c65366ad448e536e75dc92886527b8fdeccb8e84c6d68c480b287c584347edbe87f3d089765f571e84528b73cdd65bef

  • memory/1812-136-0x0000000000000000-mapping.dmp

  • memory/1812-137-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1812-139-0x0000000005770000-0x00000000057D6000-memory.dmp

    Filesize

    408KB

  • memory/1812-140-0x0000000007280000-0x000000000728A000-memory.dmp

    Filesize

    40KB

  • memory/1812-141-0x0000000008450000-0x00000000084A0000-memory.dmp

    Filesize

    320KB

  • memory/2088-134-0x0000000000000000-mapping.dmp

  • memory/4264-130-0x0000000000BD0000-0x0000000000CA8000-memory.dmp

    Filesize

    864KB

  • memory/4264-131-0x00000000056D0000-0x000000000576C000-memory.dmp

    Filesize

    624KB

  • memory/4264-132-0x0000000005770000-0x0000000005802000-memory.dmp

    Filesize

    584KB

  • memory/4264-133-0x0000000007730000-0x0000000007CD4000-memory.dmp

    Filesize

    5.6MB