Analysis Overview
SHA256
6e9e3820339794ba98309ccfddbd4f251cc935445d6640b5c9b13a0b12129213
Threat Level: Known bad
The file 6e9e3820339794ba98309ccfddbd4f251cc935445d6640b5c9b13a0b12129213 was found to be: Known bad.
Malicious Activity Summary
MassLogger
MassLogger log file
MassLogger Main Payload
Reads user/profile data of web browsers
Checks computer location settings
Looks up external IP address via web service
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
outlook_win_path
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: AddClipboardFormatListener
outlook_office_path
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-21 12:23
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-21 12:23
Reported
2022-05-21 12:35
Platform
win7-20220414-en
Max time kernel
127s
Max time network
152s
Command Line
Signatures
MassLogger
MassLogger Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
MassLogger log file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 948 set thread context of 1088 | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe"
C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 8.8.8.8:53 | mail.chemshire.org | udp |
Files
memory/948-54-0x00000000008F0000-0x00000000009B6000-memory.dmp
memory/948-55-0x0000000075801000-0x0000000075803000-memory.dmp
memory/948-56-0x0000000000540000-0x0000000000548000-memory.dmp
memory/948-57-0x00000000043C0000-0x0000000004464000-memory.dmp
memory/948-58-0x0000000000570000-0x0000000000586000-memory.dmp
memory/948-59-0x0000000000600000-0x0000000000612000-memory.dmp
memory/1088-60-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-61-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-63-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-64-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-65-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-66-0x00000000004A15EE-mapping.dmp
memory/1088-68-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-70-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-72-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-74-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-76-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-78-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-80-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-82-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-84-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-86-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-88-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-90-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-92-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-94-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-96-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-98-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-100-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-102-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-104-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-106-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-108-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-110-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-112-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-114-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-116-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-118-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-120-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-122-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/1088-572-0x0000000000DF0000-0x0000000000E34000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-21 12:23
Reported
2022-05-21 12:34
Platform
win10v2004-20220414-en
Max time kernel
150s
Max time network
129s
Command Line
Signatures
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe"
Network
| Country | Destination | Domain | Proto |
| GB | 51.132.193.105:443 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| US | 8.253.208.112:80 | tcp | |
| US | 8.253.208.112:80 | tcp | |
| US | 8.253.208.112:80 | tcp | |
| FR | 2.18.109.224:443 | tcp | |
| US | 104.18.24.243:80 | tcp |
Files
memory/4120-130-0x0000000000210000-0x00000000002D6000-memory.dmp
memory/4120-131-0x00000000052C0000-0x0000000005864000-memory.dmp
memory/4120-132-0x0000000004D10000-0x0000000004DA2000-memory.dmp
memory/4120-133-0x0000000004C90000-0x0000000004C9A000-memory.dmp
memory/4120-134-0x0000000005080000-0x000000000511C000-memory.dmp
memory/4120-135-0x0000000005220000-0x0000000005286000-memory.dmp