Analysis
-
max time kernel
180s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:26
Static task
static1
Behavioral task
behavioral1
Sample
TT COPY osdnsufsuifhsifudsujdfs,,,,.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
TT COPY osdnsufsuifhsifudsujdfs,,,,.exe
Resource
win10v2004-20220414-en
General
-
Target
TT COPY osdnsufsuifhsifudsujdfs,,,,.exe
-
Size
922KB
-
MD5
6d37e918a7aeec2a9ebde6092dc75d72
-
SHA1
ee76d5b79861aaacaae30ee7cea264324f26752e
-
SHA256
45970f8f1497ab648eb24a71690d876dc6e18ed42e95da854252ec79b7939ab6
-
SHA512
b6b1689854c52283d1debc2380b081f068684be8ab181487e29a22bb5da045aafebae3129c7cab7513a705368493f4b6d10a407548a19b5dd6b6e4100000689c
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 32 IoCs
Processes:
resource yara_rule behavioral2/memory/4612-138-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-140-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-142-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-144-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-146-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-148-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-150-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-152-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-154-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-156-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-158-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-160-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-162-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-164-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-166-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-168-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-170-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-172-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-174-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-176-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-178-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-180-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-182-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-184-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-186-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-188-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-190-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-192-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-194-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-196-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-198-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/4612-200-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exeTT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 48 api.ipify.org 49 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription pid process target process PID 2500 set thread context of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exepid process 4612 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exeTT COPY osdnsufsuifhsifudsujdfs,,,,.exepid process 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe 4612 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exeTT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription pid process Token: SeDebugPrivilege 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe Token: SeDebugPrivilege 4612 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exepid process 4612 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
TT COPY osdnsufsuifhsifudsujdfs,,,,.exedescription pid process target process PID 2500 wrote to memory of 4356 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe schtasks.exe PID 2500 wrote to memory of 4356 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe schtasks.exe PID 2500 wrote to memory of 4356 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe schtasks.exe PID 2500 wrote to memory of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 2500 wrote to memory of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 2500 wrote to memory of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 2500 wrote to memory of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 2500 wrote to memory of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 2500 wrote to memory of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 2500 wrote to memory of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe PID 2500 wrote to memory of 4612 2500 TT COPY osdnsufsuifhsifudsujdfs,,,,.exe TT COPY osdnsufsuifhsifudsujdfs,,,,.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe"C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjpUwXOPn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp68FB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TT COPY osdnsufsuifhsifudsujdfs,,,,.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp68FB.tmpFilesize
1KB
MD5b8dd0826b2fd9c0874da9312be81d750
SHA168a900e07ea2dcb78f2a07b7c0beaa752d8b1e1e
SHA2566fb9ee2f881c79e33c5f6c32f0cbe9eb8194fafe0ff216653310769f6e32e7b2
SHA51217ff6f9ba522f673e86074083502bfbac335515e6002ef9451ed841c9f5a88652178c8689bc29816c612489e92eb57a6c1abc36ede68fa05c7f57fd0474b4c7c
-
memory/2500-130-0x0000000000270000-0x000000000035E000-memory.dmpFilesize
952KB
-
memory/2500-131-0x0000000007610000-0x0000000007BB4000-memory.dmpFilesize
5.6MB
-
memory/2500-132-0x0000000007100000-0x0000000007192000-memory.dmpFilesize
584KB
-
memory/2500-133-0x00000000070A0000-0x00000000070AA000-memory.dmpFilesize
40KB
-
memory/2500-134-0x000000000ADB0000-0x000000000AE4C000-memory.dmpFilesize
624KB
-
memory/4356-135-0x0000000000000000-mapping.dmp
-
memory/4612-162-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-170-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-140-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-142-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-144-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-146-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-148-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-150-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-152-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-154-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-156-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-158-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-160-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-137-0x0000000000000000-mapping.dmp
-
memory/4612-164-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-166-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-168-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-138-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-172-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-174-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-176-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-178-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-180-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-182-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-184-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-186-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-188-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-190-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-192-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-194-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-196-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-198-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-200-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4612-639-0x0000000006590000-0x00000000065F6000-memory.dmpFilesize
408KB
-
memory/4612-640-0x0000000006C40000-0x0000000006C90000-memory.dmpFilesize
320KB