General

  • Target

    d8f1ff7249279c3a492eea283f2d88e32135e8683338b5d416e58a5c32554cc7

  • Size

    790KB

  • Sample

    220521-pr6r5sfhe6

  • MD5

    8176a27a6c8ef7232df4b90267427fa6

  • SHA1

    c90ae7b2bf85b4e525053b2abaa3ece27d7e73a7

  • SHA256

    d8f1ff7249279c3a492eea283f2d88e32135e8683338b5d416e58a5c32554cc7

  • SHA512

    638153b3573f2d020f2e3df50f309d3855f71e380afec817186a1a06e920192ab4162a9f1a037098c113642dbe989117f9bb97ae6022727e106563d359860065

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:13:37 PM MassLogger Started: 5/21/2022 3:13:26 PM Interval: 9 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Request for new order.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\0F48153F20\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:13:59 PM MassLogger Started: 5/21/2022 1:13:56 PM Interval: 9 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Request for new order.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

    • Target

      Request for new order.exe

    • Size

      875KB

    • MD5

      f6e60d4e007049b18de4fb87c38927c3

    • SHA1

      bba2fcd204840b1235dea163bbfeae3a59e3b763

    • SHA256

      495fdf3a95e1f56f9ec94bfdcdafe87a41be371947f24853c18cc98b24a6a281

    • SHA512

      a46e7a014a3dd577a5e9d7976845185c1f45c6c321bf8cd3c364576afbdccbe0fca7b0057f63e13416c81a60a0e63bce9c2e4ce5b26801cb179a4e6a6c62b5c3

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Modifies visibility of file extensions in Explorer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Hidden Files and Directories

1
T1158

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks