Analysis
-
max time kernel
137s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
Daily report 2_pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Daily report 2_pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Daily report 2_pdf.exe
-
Size
861KB
-
MD5
8a1fa311688ba41e6282226bb02d73a2
-
SHA1
8ba23c07edef3e0302820c811ae56705665ff12d
-
SHA256
8bc95f1ba65bf54858a20c62bf09e9e39027f8be74369c25401b5e4503b1b553
-
SHA512
1e51ee35a7da4fd7ac18c0781772260958f8e7e63694cd4b3b5a6367af34bbe8464b08620b8f2d05840ae5ec7fb1e43dccd9c8e2399ecd2c5e3c0bd791f29a50
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
exporttaipei@yandex.com - Password:
evra12345
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 32 IoCs
Processes:
resource yara_rule behavioral2/memory/860-136-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-139-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-141-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-143-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-145-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-147-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-149-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-151-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-153-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-155-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-157-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-159-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-161-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-163-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-165-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-167-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-169-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-171-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-173-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-175-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-177-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-179-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-181-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-183-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-185-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-187-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-189-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-191-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-193-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-195-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-197-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger behavioral2/memory/860-199-0x0000000000400000-0x00000000004A6000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Daily report 2_pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Daily report 2_pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
Processes:
Daily report 2_pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook Daily report 2_pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook Daily report 2_pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Daily report 2_pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 40 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Daily report 2_pdf.exedescription pid process target process PID 4792 set thread context of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Daily report 2_pdf.exepid process 860 Daily report 2_pdf.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Daily report 2_pdf.exepid process 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe 860 Daily report 2_pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Daily report 2_pdf.exedescription pid process Token: SeDebugPrivilege 860 Daily report 2_pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Daily report 2_pdf.exepid process 860 Daily report 2_pdf.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Daily report 2_pdf.exedescription pid process target process PID 4792 wrote to memory of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe PID 4792 wrote to memory of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe PID 4792 wrote to memory of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe PID 4792 wrote to memory of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe PID 4792 wrote to memory of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe PID 4792 wrote to memory of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe PID 4792 wrote to memory of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe PID 4792 wrote to memory of 860 4792 Daily report 2_pdf.exe Daily report 2_pdf.exe -
outlook_office_path 1 IoCs
Processes:
Daily report 2_pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe -
outlook_win_path 1 IoCs
Processes:
Daily report 2_pdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Daily report 2_pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Daily report 2_pdf.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Daily report 2_pdf.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
memory/860-163-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-193-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-639-0x0000000007C50000-0x0000000007CA0000-memory.dmpFilesize
320KB
-
memory/860-638-0x00000000063D0000-0x0000000006436000-memory.dmpFilesize
408KB
-
memory/860-135-0x0000000000000000-mapping.dmp
-
memory/860-136-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-161-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-139-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-141-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-143-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-145-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-147-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-149-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-151-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-153-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-155-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-157-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-165-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-199-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-197-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-159-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-167-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-169-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-171-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-173-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-175-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-177-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-179-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-181-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-183-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-185-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-187-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-189-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-191-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/860-195-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4792-130-0x0000000000AD0000-0x0000000000BAE000-memory.dmpFilesize
888KB
-
memory/4792-132-0x0000000005530000-0x00000000055C2000-memory.dmpFilesize
584KB
-
memory/4792-131-0x0000000005BC0000-0x0000000006164000-memory.dmpFilesize
5.6MB
-
memory/4792-134-0x0000000008FC0000-0x000000000905C000-memory.dmpFilesize
624KB
-
memory/4792-133-0x00000000055F0000-0x00000000055FA000-memory.dmpFilesize
40KB