Analysis
-
max time kernel
144s -
max time network
217s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:26
Static task
static1
Behavioral task
behavioral1
Sample
TT COPY osdnsufsuifhsifudsujdfs,,,,.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
TT COPY osdnsufsuifhsifudsujdfs,,,,.exe
Resource
win10v2004-20220414-en
General
-
Target
TT COPY osdnsufsuifhsifudsujdfs,,,,.exe
-
Size
922KB
-
MD5
6d37e918a7aeec2a9ebde6092dc75d72
-
SHA1
ee76d5b79861aaacaae30ee7cea264324f26752e
-
SHA256
45970f8f1497ab648eb24a71690d876dc6e18ed42e95da854252ec79b7939ab6
-
SHA512
b6b1689854c52283d1debc2380b081f068684be8ab181487e29a22bb5da045aafebae3129c7cab7513a705368493f4b6d10a407548a19b5dd6b6e4100000689c
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
logs2020@gtbenk-plc.com - Password:
mkoify147@@@
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/1944-56-0x0000000000510000-0x0000000000518000-memory.dmp coreentity -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 32 IoCs
Processes:
resource yara_rule behavioral1/memory/904-63-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-64-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-65-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-66-0x00000000004A183E-mapping.dmp family_masslogger behavioral1/memory/904-68-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-70-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-72-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-74-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-76-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-78-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-80-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-82-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-84-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-86-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-88-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-90-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-92-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-94-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-96-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-98-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-100-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-102-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-104-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-106-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-108-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-110-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-112-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-114-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-116-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-118-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-120-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral1/memory/904-122-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1944-57-0x0000000007740000-0x00000000077EE000-memory.dmp rezer0 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription pid process target process PID 1944 set thread context of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exepid process 904 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exeTT COPY osdnsufsuifhsifudsujdfs,,,,.exepid process 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe 904 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exeTT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription pid process Token: SeDebugPrivilege 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Token: SeDebugPrivilege 904 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exepid process 904 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription pid process target process PID 1944 wrote to memory of 2008 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe schtasks.exe PID 1944 wrote to memory of 2008 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe schtasks.exe PID 1944 wrote to memory of 2008 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe schtasks.exe PID 1944 wrote to memory of 2008 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe schtasks.exe PID 1944 wrote to memory of 1564 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 1564 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 1564 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 1564 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 1944 wrote to memory of 904 1944 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
outlook_office_path 1 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
outlook_win_path 1 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe"C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjpUwXOPn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1EC8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1EC8.tmpFilesize
1KB
MD50f36dca8af388ea9b4d50aba65a51fd1
SHA12acb584eaf9a66f02752b6995232f0dcb53ddd05
SHA2564cee823565380d93bf1cd68f10f367e11fd04fe98e44cb692bf2ab71d0f5aa4e
SHA512b9bc902e7ccef5e0c1065c11a5b4d0b957e79dc422563c73aed1d16cc9d2d4b171c80b10ffec188e4f37a2c1b995470f81d60bca571af3c31a9d76e70daa41cb
-
memory/904-84-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-114-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-572-0x0000000004D30000-0x0000000004D74000-memory.dmpFilesize
272KB
-
memory/904-122-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-120-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-60-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-82-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-63-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-64-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-65-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-66-0x00000000004A183E-mapping.dmp
-
memory/904-68-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-70-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-72-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-74-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-76-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-78-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-86-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-61-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-118-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-80-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-88-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-90-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-92-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-94-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-96-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-98-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-100-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-102-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-104-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-106-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-108-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-110-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-112-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/904-116-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1944-54-0x0000000000BC0000-0x0000000000CAE000-memory.dmpFilesize
952KB
-
memory/1944-56-0x0000000000510000-0x0000000000518000-memory.dmpFilesize
32KB
-
memory/1944-55-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1944-57-0x0000000007740000-0x00000000077EE000-memory.dmpFilesize
696KB
-
memory/2008-58-0x0000000000000000-mapping.dmp