General

  • Target

    4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78

  • Size

    1.4MB

  • Sample

    220521-plqhzafeg2

  • MD5

    8864cfae8bf9ce394f0b1a2261e838c2

  • SHA1

    591a959a3a8e2d09bd89e8fa1196cf5cdc737f16

  • SHA256

    4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78

  • SHA512

    c8dccfd191ae11c47feb24f344c07690afcbc5daf3bea8e031eb3c9e25a960f7999657dfa4d60d305d4a37f6e4a546802f3affd959f0111a52beb3a24f3849da

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:08:47 PM MassLogger Started: 5/21/2022 3:08:04 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:07:40 PM MassLogger Started: 5/21/2022 3:07:37 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.kogep-k.hu
  • Port:
    587
  • Username:
    dekgep@dekgep.hu
  • Password:
    Vb^4ZJR[JffqT,F2Tb

Targets

    • Target

      DHL_MAY_.EXE

    • Size

      816KB

    • MD5

      4ea547efe0fcb7dde07eb2a9c6891040

    • SHA1

      f45314bf78ce40bb81df533dbd6861260a609c4f

    • SHA256

      cd5eeb8026313e1bcfff3db5c1e30ff15477427f16e23e885df3b57adceac0b6

    • SHA512

      77f30789b5f08bf67522228d5cc818ebd12b0f681bca1d7f4f3b3694deb67c6528e8390b435fca0cadcb722aa789bb0e966e6c4f2434382c3660192d54db2025

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks