Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 12:31

General

  • Target

    Daily report 2_pdf.exe

  • Size

    861KB

  • MD5

    8a1fa311688ba41e6282226bb02d73a2

  • SHA1

    8ba23c07edef3e0302820c811ae56705665ff12d

  • SHA256

    8bc95f1ba65bf54858a20c62bf09e9e39027f8be74369c25401b5e4503b1b553

  • SHA512

    1e51ee35a7da4fd7ac18c0781772260958f8e7e63694cd4b3b5a6367af34bbe8464b08620b8f2d05840ae5ec7fb1e43dccd9c8e2399ecd2c5e3c0bd791f29a50

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:41:15 PM MassLogger Started: 5/21/2022 2:40:45 PM Interval: 6 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe As Administrator: True

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    exporttaipei@yandex.com
  • Password:
    evra12345

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 32 IoCs
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe
      "{path}"
      2⤵
        PID:272
      • C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe
        "{path}"
        2⤵
          PID:1792
        • C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe
          "{path}"
          2⤵
            PID:1736
          • C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe
            "{path}"
            2⤵
              PID:1584
            • C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe
              "{path}"
              2⤵
              • Checks computer location settings
              • Accesses Microsoft Outlook profiles
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • outlook_office_path
              • outlook_win_path
              PID:1676

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          Collection

          Data from Local System

          1
          T1005

          Email Collection

          1
          T1114

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1216-54-0x0000000000020000-0x00000000000FE000-memory.dmp
            Filesize

            888KB

          • memory/1216-55-0x00000000759F1000-0x00000000759F3000-memory.dmp
            Filesize

            8KB

          • memory/1216-56-0x00000000004E0000-0x00000000004F0000-memory.dmp
            Filesize

            64KB

          • memory/1216-57-0x0000000007F40000-0x0000000007FEE000-memory.dmp
            Filesize

            696KB

          • memory/1676-58-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-59-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-61-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-62-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-63-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-64-0x00000000004A1E3E-mapping.dmp
          • memory/1676-66-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-68-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-70-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-72-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-74-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-76-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-78-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-80-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-82-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-84-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-86-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-88-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-90-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-92-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-94-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-96-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-98-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-100-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-102-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-104-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-106-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-108-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-110-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-114-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-112-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-116-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-120-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-118-0x0000000000400000-0x00000000004A6000-memory.dmp
            Filesize

            664KB

          • memory/1676-570-0x00000000041B0000-0x00000000041F4000-memory.dmp
            Filesize

            272KB