Analysis
-
max time kernel
59s -
max time network
64s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:19
Static task
static1
Behavioral task
behavioral1
Sample
3246744-28-06.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3246744-28-06.exe
Resource
win10v2004-20220414-en
General
-
Target
3246744-28-06.exe
-
Size
1.1MB
-
MD5
a60ca849b4d2490671b6e54a97b09e87
-
SHA1
8d02d04d3bbd2ad7c4aae65189d8e289adabbbe1
-
SHA256
b51612fb244526a66524e234ccae2d57f1c98a37080fd94664626bcdcf6c4bbb
-
SHA512
33ffd9ac6db80c40d7f3970d25149378c7cd606c603541cf4544076ad80b6aea628df1bc8466dbd0c870f322b05cb0da47668af8758581b0f7e3d0d041dfc0ed
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
m4cfund@yandex.com - Password:
Dmacdavid
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 1416 InstallUtil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
InstallUtil.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation InstallUtil.exe -
Loads dropped DLL 1 IoCs
Processes:
3246744-28-06.exepid process 912 3246744-28-06.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3246744-28-06.exedescription pid process target process PID 912 set thread context of 1416 912 3246744-28-06.exe InstallUtil.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
InstallUtil.exepid process 1416 InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3246744-28-06.exeInstallUtil.exepid process 912 3246744-28-06.exe 912 3246744-28-06.exe 912 3246744-28-06.exe 1416 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3246744-28-06.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 912 3246744-28-06.exe Token: SeDebugPrivilege 1416 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 1416 InstallUtil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3246744-28-06.exedescription pid process target process PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe PID 912 wrote to memory of 1416 912 3246744-28-06.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3246744-28-06.exe"C:\Users\Admin\AppData\Local\Temp\3246744-28-06.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/912-55-0x0000000000460000-0x0000000000466000-memory.dmpFilesize
24KB
-
memory/912-54-0x0000000000010000-0x0000000000126000-memory.dmpFilesize
1.1MB
-
memory/1416-85-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-89-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-62-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-63-0x00000000004A12AE-mapping.dmp
-
memory/1416-60-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-66-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-68-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-58-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-71-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-73-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-75-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-77-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-79-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-81-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-83-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-57-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-87-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-61-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-91-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-93-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-95-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-97-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-99-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-101-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-103-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-105-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-107-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-109-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-111-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-113-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-115-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-117-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-119-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-121-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-123-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1416-575-0x0000000004D10000-0x0000000004D54000-memory.dmpFilesize
272KB