Analysis
-
max time kernel
90s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:29
Static task
static1
Behavioral task
behavioral1
Sample
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe
Resource
win10v2004-20220414-en
General
-
Target
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe
-
Size
899KB
-
MD5
226ccf305c0971c6634d956809ee618f
-
SHA1
55615741a7d8f84f7edaaf0c5bc851944532f98d
-
SHA256
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c
-
SHA512
2e0a60a33409a36cc3703fefcaa64f3c7907e53736bc549c5c7f3c93e99d0aba1e4fcbbaa82fe301724f7f93e47fc5f12957452baee9829966193a568d22a80c
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
mail.mkontakt.az - Port:
587 - Username:
testing@mkontakt.az - Password:
Onyeoba111
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 32 IoCs
Processes:
resource yara_rule behavioral1/memory/1328-61-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-62-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-63-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-64-0x00000000004ABAAE-mapping.dmp family_masslogger behavioral1/memory/1328-66-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-68-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-70-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-72-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-74-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-76-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-78-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-80-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-82-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-84-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-90-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-88-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-96-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-100-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-98-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-94-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-102-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-92-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-104-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-86-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-106-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-110-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-108-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-114-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-112-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-116-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-118-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger behavioral1/memory/1328-120-0x0000000000400000-0x00000000004B0000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exedescription pid process target process PID 880 set thread context of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exepid process 1328 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exepid process 1328 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 1328 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exedescription pid process Token: SeDebugPrivilege 1328 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exepid process 1328 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exedescription pid process target process PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe PID 880 wrote to memory of 1328 880 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
outlook_office_path 1 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe -
outlook_win_path 1 IoCs
Processes:
4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe"C:\Users\Admin\AppData\Local\Temp\4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/880-54-0x0000000000BA0000-0x0000000000C86000-memory.dmpFilesize
920KB
-
memory/880-55-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/880-56-0x00000000005B0000-0x00000000005CC000-memory.dmpFilesize
112KB
-
memory/880-57-0x0000000005730000-0x00000000057E8000-memory.dmpFilesize
736KB
-
memory/1328-58-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-59-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-61-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-62-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-63-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-64-0x00000000004ABAAE-mapping.dmp
-
memory/1328-66-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-68-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-70-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-72-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-74-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-76-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-78-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-80-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-82-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-84-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-90-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-88-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-96-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-100-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-98-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-94-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-102-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-92-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-104-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-86-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-106-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-110-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-108-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-114-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-112-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-116-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-118-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-120-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1328-577-0x0000000000570000-0x00000000005B4000-memory.dmpFilesize
272KB
-
memory/1328-579-0x0000000000B55000-0x0000000000B66000-memory.dmpFilesize
68KB
-
memory/1328-580-0x0000000000B30000-0x0000000000B44000-memory.dmpFilesize
80KB