Analysis
- max time kernel
106s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/05/2022, 12:40
General
- Target Scan_DSV_03072020_038465318631_PDF.exe
- Size 820KB
- Sample220521-pwh7msgag4
- SHA256 c4349d30167ec1dfd9c70454c3f91a5ac21d52d433c093391462bc3f995e7781
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\19E979543A\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:16:29 PM MassLogger Started: 5/21/2022 3:16:25 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.ru
-
Port
587
-
Username
-
Password
whayasaynewnew
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 32 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan_DSV_03072020_038465318631_PDF.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Scan_DSV_03072020_038465318631_PDF.exe.log
memory/1392-131-0x0000000005770000-0x0000000005D14000-memory.dmp
memory/1392-132-0x00000000050F0000-0x0000000005182000-memory.dmp
memory/1392-133-0x00000000051A0000-0x00000000051AA000-memory.dmp
memory/1392-134-0x0000000007CA0000-0x0000000007D3C000-memory.dmp
memory/1392-130-0x0000000000680000-0x0000000000754000-memory.dmp
memory/4504-163-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-169-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-141-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-139-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-143-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-145-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-147-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-149-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-151-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-153-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-155-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-157-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-159-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-161-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-165-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-167-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-136-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-171-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-173-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-175-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-177-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-179-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-181-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-183-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-185-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-187-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-189-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-191-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-193-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-195-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-197-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-199-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4504-646-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/4504-647-0x0000000006D50000-0x0000000006DA0000-memory.dmp