Analysis
-
max time kernel
118s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:19
Static task
static1
Behavioral task
behavioral1
Sample
3246744-28-06.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3246744-28-06.exe
Resource
win10v2004-20220414-en
General
-
Target
3246744-28-06.exe
-
Size
1.1MB
-
MD5
a60ca849b4d2490671b6e54a97b09e87
-
SHA1
8d02d04d3bbd2ad7c4aae65189d8e289adabbbe1
-
SHA256
b51612fb244526a66524e234ccae2d57f1c98a37080fd94664626bcdcf6c4bbb
-
SHA512
33ffd9ac6db80c40d7f3970d25149378c7cd606c603541cf4544076ad80b6aea628df1bc8466dbd0c870f322b05cb0da47668af8758581b0f7e3d0d041dfc0ed
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\F293CD6622\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
m4cfund@yandex.com - Password:
Dmacdavid
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 2916 InstallUtil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
InstallUtil.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation InstallUtil.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 36 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3246744-28-06.exedescription pid process target process PID 4408 set thread context of 2916 4408 3246744-28-06.exe InstallUtil.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
InstallUtil.exepid process 2916 InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
3246744-28-06.exeInstallUtil.exepid process 4408 3246744-28-06.exe 4408 3246744-28-06.exe 4408 3246744-28-06.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe 2916 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3246744-28-06.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4408 3246744-28-06.exe Token: SeDebugPrivilege 2916 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 2916 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3246744-28-06.exedescription pid process target process PID 4408 wrote to memory of 2916 4408 3246744-28-06.exe InstallUtil.exe PID 4408 wrote to memory of 2916 4408 3246744-28-06.exe InstallUtil.exe PID 4408 wrote to memory of 2916 4408 3246744-28-06.exe InstallUtil.exe PID 4408 wrote to memory of 2916 4408 3246744-28-06.exe InstallUtil.exe PID 4408 wrote to memory of 2916 4408 3246744-28-06.exe InstallUtil.exe PID 4408 wrote to memory of 2916 4408 3246744-28-06.exe InstallUtil.exe PID 4408 wrote to memory of 2916 4408 3246744-28-06.exe InstallUtil.exe PID 4408 wrote to memory of 2916 4408 3246744-28-06.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3246744-28-06.exe"C:\Users\Admin\AppData\Local\Temp\3246744-28-06.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
memory/2916-163-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-141-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-134-0x0000000000000000-mapping.dmp
-
memory/2916-167-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-645-0x00000000075C0000-0x000000000765C000-memory.dmpFilesize
624KB
-
memory/2916-171-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-139-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-169-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-143-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-145-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-147-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-149-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-151-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-153-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-155-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-157-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-161-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-159-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-644-0x0000000007010000-0x0000000007060000-memory.dmpFilesize
320KB
-
memory/2916-165-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-135-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-643-0x00000000063C0000-0x00000000063CA000-memory.dmpFilesize
40KB
-
memory/2916-642-0x0000000005F00000-0x0000000005F66000-memory.dmpFilesize
408KB
-
memory/2916-173-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-175-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-177-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-179-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-181-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-183-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-185-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-187-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-189-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-191-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-193-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-195-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-197-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2916-199-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4408-131-0x000000000AA70000-0x000000000AB02000-memory.dmpFilesize
584KB
-
memory/4408-133-0x0000000004ED0000-0x0000000004F14000-memory.dmpFilesize
272KB
-
memory/4408-130-0x0000000000970000-0x0000000000A86000-memory.dmpFilesize
1.1MB
-
memory/4408-132-0x000000000B0C0000-0x000000000B664000-memory.dmpFilesize
5.6MB