General
Target

Order Inquiry List.exe

Filesize

1MB

Completed

21-05-2022 18:55

Task

behavioral1

Score
10/10
MD5

4c812fc87fce65e0cb5011a55b453200

SHA1

6a92d646c4858b718b10bbd2a5a41faab41a25a9

SHA256

ea23ee7d6471b33c86c5eac4f96c09f060aaf5fcb7847b4ebc386a16871ee64c

SHA256

32360dbfc573335d91f8b5a67dce3830ee72614d342ff4b717924393af3bbc0d0e0d009d4baec786fadaf3c5d6e2782b1fc01368b96a4344803b1943222c1ba9

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 8:54:01 PM MassLogger Started: 5/21/2022 8:53:54 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Window Searcher ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA
Signatures 15

Filter: none

Collection
Credential Access
Discovery
  • MassLogger

    Description

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2012-62-0x0000000000400000-0x00000000004B8000-memory.dmpfamily_masslogger
    behavioral1/memory/2012-63-0x0000000000400000-0x00000000004B8000-memory.dmpfamily_masslogger
    behavioral1/memory/2012-65-0x00000000004B34AE-mapping.dmpfamily_masslogger
    behavioral1/memory/2012-64-0x0000000000400000-0x00000000004B8000-memory.dmpfamily_masslogger
    behavioral1/memory/2012-67-0x0000000000400000-0x00000000004B8000-memory.dmpfamily_masslogger
    behavioral1/memory/2012-69-0x0000000000400000-0x00000000004B8000-memory.dmpfamily_masslogger
  • MassLogger log file

    Description

    Detects a log file produced by MassLogger.

    Reported IOCs

    yara_rule
    masslogger_log_file
  • Checks computer location settings
    Order Inquiry List.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\NationOrder Inquiry List.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses Microsoft Outlook profiles
    Order Inquiry List.exe

    Tags

    TTPs

    Email Collection

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\OutlookOrder Inquiry List.exe
    Key opened\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key opened\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key opened\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key opened\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key opened\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\OutlookOrder Inquiry List.exe
    Key opened\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key opened\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\OutlookOrder Inquiry List.exe
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    4api.ipify.org
  • Suspicious use of SetThreadContext
    Order Inquiry List.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1960 set thread context of 20121960Order Inquiry List.exeOrder Inquiry List.exe
  • Suspicious behavior: AddClipboardFormatListener
    Order Inquiry List.exe

    Reported IOCs

    pidprocess
    2012Order Inquiry List.exe
  • Suspicious behavior: EnumeratesProcesses
    Order Inquiry List.exeOrder Inquiry List.exe

    Reported IOCs

    pidprocess
    1960Order Inquiry List.exe
    1960Order Inquiry List.exe
    1960Order Inquiry List.exe
    1960Order Inquiry List.exe
    2012Order Inquiry List.exe
    2012Order Inquiry List.exe
    2012Order Inquiry List.exe
    2012Order Inquiry List.exe
  • Suspicious use of AdjustPrivilegeToken
    Order Inquiry List.exeOrder Inquiry List.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1960Order Inquiry List.exe
    Token: SeDebugPrivilege2012Order Inquiry List.exe
  • Suspicious use of SetWindowsHookEx
    Order Inquiry List.exe

    Reported IOCs

    pidprocess
    2012Order Inquiry List.exe
  • Suspicious use of WriteProcessMemory
    Order Inquiry List.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1960 wrote to memory of 12641960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 12641960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 12641960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 12641960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20001960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20001960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20001960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20001960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 18281960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 18281960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 18281960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 18281960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20281960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20281960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20281960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20281960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
    PID 1960 wrote to memory of 20121960Order Inquiry List.exeOrder Inquiry List.exe
  • outlook_office_path
    Order Inquiry List.exe

    Reported IOCs

    descriptioniocprocess
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
  • outlook_win_path
    Order Inquiry List.exe

    Reported IOCs

    descriptioniocprocess
    Key queried\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Order Inquiry List.exe
Processes 6
  • C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe
    "C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe
      "C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe"
      PID:1264
    • C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe
      "C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe"
      PID:2000
    • C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe
      "C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe"
      PID:1828
    • C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe
      "C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe"
      PID:2028
    • C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe
      "C:\Users\Admin\AppData\Local\Temp\Order Inquiry List.exe"
      Checks computer location settings
      Accesses Microsoft Outlook profiles
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      outlook_office_path
      outlook_win_path
      PID:2012
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • memory/1960-54-0x0000000000200000-0x0000000000338000-memory.dmp

                    • memory/1960-55-0x0000000075A61000-0x0000000075A63000-memory.dmp

                    • memory/1960-56-0x00000000003D0000-0x00000000003E0000-memory.dmp

                    • memory/1960-57-0x0000000005870000-0x0000000005964000-memory.dmp

                    • memory/1960-58-0x0000000005280000-0x0000000005348000-memory.dmp

                    • memory/2012-62-0x0000000000400000-0x00000000004B8000-memory.dmp

                    • memory/2012-60-0x0000000000400000-0x00000000004B8000-memory.dmp

                    • memory/2012-59-0x0000000000400000-0x00000000004B8000-memory.dmp

                    • memory/2012-63-0x0000000000400000-0x00000000004B8000-memory.dmp

                    • memory/2012-65-0x00000000004B34AE-mapping.dmp

                    • memory/2012-64-0x0000000000400000-0x00000000004B8000-memory.dmp

                    • memory/2012-67-0x0000000000400000-0x00000000004B8000-memory.dmp

                    • memory/2012-69-0x0000000000400000-0x00000000004B8000-memory.dmp

                    • memory/2012-70-0x0000000004420000-0x0000000004498000-memory.dmp

                    • memory/2012-72-0x0000000004F15000-0x0000000004F26000-memory.dmp