Analysis

  • max time kernel
    91s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 12:24

General

  • Target

    PAGO_ADJ.exe

  • Size

    1MB

  • MD5

    b69ef4759dddf4f965bf84d654a555ff

  • SHA1

    f894b62e29c20cdd562f02001c5ce30ca5609bb9

  • SHA256

    7ecde113e9bcf315e61368cce51deda2e51321684d9d8e943a31ab1d457988f7

  • SHA512

    529766ef4faa26b9c5e8a2bffd390c64d038724a7492caf5790550062c195ba5d6f2c2d97ad0e6fc5e2a03bf4fc3af6b41c0c4a3a7db9b0fa2e33884f38827cb

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\781F780B4E\Log.txt

Family

masslogger

Ransom Note ################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:34:47 PM MassLogger Started: 5/21/2022 12:34:43 PM Interval: 6 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe As Administrator: True

Extracted

Credentials

Protocol: ftp

Host: ftp.sisbg.net

Port: 21

Username: ntums@sisbg.net

Password: alibaba.com

Signatures 11

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload ⋅ 33 IoCs
  • MassLogger log file ⋅ 1 IoCs

    Detects a log file produced by MassLogger.

  • Accesses Microsoft Outlook profiles ⋅ 1 TTPs 18 IoCs
  • Looks up external IP address via web service ⋅ 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 3 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 8 IoCs
  • outlook_office_path ⋅ 1 IoCs
  • outlook_win_path ⋅ 1 IoCs

Processes 2

  • C:\Users\Admin\AppData\Local\Temp\PAGO_ADJ.exe
    "C:\Users\Admin\AppData\Local\Temp\PAGO_ADJ.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      Accesses Microsoft Outlook profiles
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:4424

Network

MITRE ATT&CK Matrix

Collection

Command and Control

    Credential Access

      Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • memory/2992-130-0x0000000000540000-0x0000000000682000-memory.dmp
                        • memory/2992-131-0x0000000005600000-0x0000000005BA4000-memory.dmp
                        • memory/2992-132-0x0000000005150000-0x00000000051E2000-memory.dmp
                        • memory/2992-133-0x00000000052F0000-0x0000000005334000-memory.dmp
                        • memory/4424-134-0x0000000000000000-mapping.dmp
                        • memory/4424-135-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-137-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-139-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-141-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-143-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-147-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-145-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-149-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-151-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-153-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-155-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-157-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-159-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-161-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-163-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-165-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-167-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-169-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-171-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-173-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-175-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-177-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-181-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-179-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-183-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-185-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-187-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-189-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-191-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-193-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-195-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-197-0x0000000000400000-0x00000000004A8000-memory.dmp
                        • memory/4424-634-0x0000000006050000-0x00000000060B6000-memory.dmp
                        • memory/4424-635-0x00000000063F0000-0x00000000063FA000-memory.dmp
                        • memory/4424-636-0x0000000006830000-0x0000000006880000-memory.dmp
                        • memory/4424-637-0x0000000006A20000-0x0000000006ABC000-memory.dmp