Overview

overview

10

Static

static

p0flf49bEs68ze7.exe

windows7_x64

9

p0flf49bEs68ze7.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 12:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    p0flf49bEs68ze7.exe

  • Size

    736KB

  • MD5

    f86c5e35abb842290ce1773b6a4e7d0f

  • SHA1

    b14fc3de5165c84c5dac9e39e6c0695710fb3549

  • SHA256

    76933bfe9afdf8d266352155f09995acadcab23345fabe2518d5bf15d45c9cd4

  • SHA512

    aad5cfbe0de8979deb1800f90467fe7f8426889ff3ad836511c04985d3c1eb51138e94f0c209dcd9663739bb677c0f4e28257d582972df6c0fabb6b4efb6622c

Score
10/10
massloggercollectionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8236ADF044\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v2.0.0.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:33:51 PM MassLogger Started: 5/21/2022 2:33:40 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\p0flf49bEs68ze7.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    bob@metalfabme.icu
  • Password:
    @Mexico1.,

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\p0flf49bEs68ze7.exe
    "C:\Users\Admin\AppData\Local\Temp\p0flf49bEs68ze7.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JYFAGrRGPfsz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp391C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4544
    • C:\Users\Admin\AppData\Local\Temp\p0flf49bEs68ze7.exe
      "{path}"
      2⤵
        PID:4716
      • C:\Users\Admin\AppData\Local\Temp\p0flf49bEs68ze7.exe
        "{path}"
        2⤵
          PID:1092
        • C:\Users\Admin\AppData\Local\Temp\p0flf49bEs68ze7.exe
          "{path}"
          2⤵
          • Checks computer location settings
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • outlook_office_path
          • outlook_win_path
          PID:4964

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Email Collection

      1
      T1114

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp391C.tmp
        Filesize

        1KB

        MD5

        f92e0ad7da878f270dcfeb3cd4776ba1

        SHA1

        351e78b5811f9d45afa763e1a2b707a5278c7af9

        SHA256

        29de4e7b4dc6fe770340293cf283d5f0f0b091ccbdcaffa148c70580a9d15876

        SHA512

        cfa5b8901ceb30d4e2a1bdb09e01101e6c5c66a8095df06e8c7b06368dc623a24ce69d4bb2b35c746198905525e445d5b989ece3f41cfc5472e3aeb8a06e58a8

        Download Submit
      • memory/1092-138-0x0000000000000000-mapping.dmp
        Download
      • memory/2580-133-0x00000000058F0000-0x00000000058FA000-memory.dmp
        Filesize

        40KB

        Download
      • memory/2580-130-0x0000000000FC0000-0x000000000107E000-memory.dmp
        Filesize

        760KB

        Download
      • memory/2580-134-0x0000000009340000-0x00000000093DC000-memory.dmp
        Filesize

        624KB

        Download
      • memory/2580-132-0x0000000005950000-0x00000000059E2000-memory.dmp
        Filesize

        584KB

        Download
      • memory/2580-131-0x0000000005F00000-0x00000000064A4000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/4544-135-0x0000000000000000-mapping.dmp
        Download
      • memory/4716-137-0x0000000000000000-mapping.dmp
        Download
      • memory/4964-139-0x0000000000000000-mapping.dmp
        Download
      • memory/4964-140-0x0000000000400000-0x000000000048E000-memory.dmp
        Filesize

        568KB

        Download
      • memory/4964-141-0x00000000052E0000-0x0000000005346000-memory.dmp
        Filesize

        408KB

        Download
      • memory/4964-142-0x0000000008590000-0x00000000085E0000-memory.dmp
        Filesize

        320KB

        Download