Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 18:55
Static task
static1
Behavioral task
behavioral1
Sample
Veitstar Inquiry.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Veitstar Inquiry.exe
Resource
win10v2004-20220414-en
General
-
Target
Veitstar Inquiry.exe
-
Size
2.5MB
-
MD5
5c8c2fb2fbd3c20a62a107e34226e90f
-
SHA1
c85262bd4d832a4ef68ef1940cee8501d1cab90e
-
SHA256
44a169140fbd4a243478d8504cb62dd7a5d2225df55d058c4aa71dd0c0d7c480
-
SHA512
9912e0231369acce4cf7b63e1f2d06c76a0161bc85e13789ab02129774de8dcf6c57f30a694d8180491e7eb42112cd22c75d79587882f836255919fcde11f246
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\2EF8342664\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
m4cfund@yandex.com - Password:
Dmacdavid
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 4712 InstallUtil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
InstallUtil.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation InstallUtil.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Veitstar Inquiry.exedescription pid process target process PID 1884 set thread context of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
InstallUtil.exepid process 4712 InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Veitstar Inquiry.exeInstallUtil.exepid process 1884 Veitstar Inquiry.exe 1884 Veitstar Inquiry.exe 1884 Veitstar Inquiry.exe 4712 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Veitstar Inquiry.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1884 Veitstar Inquiry.exe Token: SeDebugPrivilege 4712 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 4712 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Veitstar Inquiry.exedescription pid process target process PID 1884 wrote to memory of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe PID 1884 wrote to memory of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe PID 1884 wrote to memory of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe PID 1884 wrote to memory of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe PID 1884 wrote to memory of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe PID 1884 wrote to memory of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe PID 1884 wrote to memory of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe PID 1884 wrote to memory of 4712 1884 Veitstar Inquiry.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Veitstar Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\Veitstar Inquiry.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
memory/1884-131-0x00000000052E0000-0x0000000005884000-memory.dmpFilesize
5.6MB
-
memory/1884-132-0x0000000004DD0000-0x0000000004E62000-memory.dmpFilesize
584KB
-
memory/1884-133-0x0000000005990000-0x00000000059D4000-memory.dmpFilesize
272KB
-
memory/1884-134-0x0000000006BD0000-0x0000000006BF2000-memory.dmpFilesize
136KB
-
memory/1884-130-0x00000000002D0000-0x000000000055A000-memory.dmpFilesize
2.5MB
-
memory/4712-166-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-174-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-140-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-142-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-144-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-146-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-148-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-150-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-152-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-154-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-156-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-158-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-160-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-162-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-164-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-135-0x0000000000000000-mapping.dmp
-
memory/4712-168-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-170-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-172-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-136-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-176-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-178-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-180-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-182-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-184-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-186-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-188-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-190-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-192-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-194-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-196-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-198-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-200-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/4712-643-0x0000000006110000-0x0000000006176000-memory.dmpFilesize
408KB
-
memory/4712-644-0x00000000064D0000-0x00000000064DA000-memory.dmpFilesize
40KB
-
memory/4712-645-0x0000000007E50000-0x0000000007EA0000-memory.dmpFilesize
320KB
-
memory/4712-646-0x0000000007F40000-0x0000000007FDC000-memory.dmpFilesize
624KB