Analysis
-
max time kernel
92s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 21:31
Static task
static1
Behavioral task
behavioral1
Sample
74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe
Resource
win10v2004-20220414-en
General
-
Target
74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe
-
Size
900KB
-
MD5
b720141599d9a092ef93bd69ba3d6e3d
-
SHA1
4718853ced0c3010ad7f8c60155b6b32cee5aa44
-
SHA256
74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144
-
SHA512
e0c6854b51746019e337ce9f23248c4e973f75b7e521348bfd80a545c21d9ffbd5f40e7c368f875625c2c3452c5800bb1146daa9316d4a5159570794ccc4203f
Malware Config
Extracted
C:\Users\Admin\AppData\Local\F95B724EDE\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4220-139-0x0000000000C20000-0x0000000000CBA000-memory.dmp family_masslogger behavioral2/memory/4220-140-0x0000000000C20000-0x0000000000CBA000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Executes dropped EXE 3 IoCs
Processes:
hshshbe.exehshshbe.exehshshbe.exepid process 4188 hshshbe.exe 4220 hshshbe.exe 4300 hshshbe.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
hshshbe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation hshshbe.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs notepad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
hshshbe.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook hshshbe.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook hshshbe.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook hshshbe.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hshshbe.exedescription pid process target process PID 4188 set thread context of 4220 4188 hshshbe.exe hshshbe.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exe:ZoneIdentifier notepad.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
hshshbe.exepid process 4220 hshshbe.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exehshshbe.exehshshbe.exepid process 3744 74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe 3744 74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe 4188 hshshbe.exe 4188 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe 4300 hshshbe.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
hshshbe.exepid process 4188 hshshbe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hshshbe.exedescription pid process Token: SeDebugPrivilege 4220 hshshbe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
hshshbe.exepid process 4220 hshshbe.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exenotepad.exehshshbe.exedescription pid process target process PID 3744 wrote to memory of 3888 3744 74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe notepad.exe PID 3744 wrote to memory of 3888 3744 74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe notepad.exe PID 3744 wrote to memory of 3888 3744 74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe notepad.exe PID 3744 wrote to memory of 3888 3744 74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe notepad.exe PID 3744 wrote to memory of 3888 3744 74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe notepad.exe PID 3888 wrote to memory of 4188 3888 notepad.exe hshshbe.exe PID 3888 wrote to memory of 4188 3888 notepad.exe hshshbe.exe PID 3888 wrote to memory of 4188 3888 notepad.exe hshshbe.exe PID 4188 wrote to memory of 4220 4188 hshshbe.exe hshshbe.exe PID 4188 wrote to memory of 4220 4188 hshshbe.exe hshshbe.exe PID 4188 wrote to memory of 4220 4188 hshshbe.exe hshshbe.exe PID 4188 wrote to memory of 4300 4188 hshshbe.exe hshshbe.exe PID 4188 wrote to memory of 4300 4188 hshshbe.exe hshshbe.exe PID 4188 wrote to memory of 4300 4188 hshshbe.exe hshshbe.exe -
outlook_office_path 1 IoCs
Processes:
hshshbe.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe -
outlook_win_path 1 IoCs
Processes:
hshshbe.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshshbe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe"C:\Users\Admin\AppData\Local\Temp\74aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exe"C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exe"C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exe"C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exe" 2 4220 2405716091⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exeFilesize
900KB
MD5b720141599d9a092ef93bd69ba3d6e3d
SHA14718853ced0c3010ad7f8c60155b6b32cee5aa44
SHA25674aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144
SHA512e0c6854b51746019e337ce9f23248c4e973f75b7e521348bfd80a545c21d9ffbd5f40e7c368f875625c2c3452c5800bb1146daa9316d4a5159570794ccc4203f
-
C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exeFilesize
900KB
MD5b720141599d9a092ef93bd69ba3d6e3d
SHA14718853ced0c3010ad7f8c60155b6b32cee5aa44
SHA25674aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144
SHA512e0c6854b51746019e337ce9f23248c4e973f75b7e521348bfd80a545c21d9ffbd5f40e7c368f875625c2c3452c5800bb1146daa9316d4a5159570794ccc4203f
-
C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exeFilesize
900KB
MD5b720141599d9a092ef93bd69ba3d6e3d
SHA14718853ced0c3010ad7f8c60155b6b32cee5aa44
SHA25674aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144
SHA512e0c6854b51746019e337ce9f23248c4e973f75b7e521348bfd80a545c21d9ffbd5f40e7c368f875625c2c3452c5800bb1146daa9316d4a5159570794ccc4203f
-
C:\Users\Admin\AppData\Roaming\appdata\hshshbe.exeFilesize
900KB
MD5b720141599d9a092ef93bd69ba3d6e3d
SHA14718853ced0c3010ad7f8c60155b6b32cee5aa44
SHA25674aa9c168ed4ff298ce0d2737342decc9a4ffaf3c03e32965a88e9f6b0ed0144
SHA512e0c6854b51746019e337ce9f23248c4e973f75b7e521348bfd80a545c21d9ffbd5f40e7c368f875625c2c3452c5800bb1146daa9316d4a5159570794ccc4203f
-
memory/3744-131-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/3888-130-0x0000000000000000-mapping.dmp
-
memory/4188-141-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/4188-132-0x0000000000000000-mapping.dmp
-
memory/4220-140-0x0000000000C20000-0x0000000000CBA000-memory.dmpFilesize
616KB
-
memory/4220-139-0x0000000000C20000-0x0000000000CBA000-memory.dmpFilesize
616KB
-
memory/4220-135-0x0000000000000000-mapping.dmp
-
memory/4220-143-0x0000000005120000-0x00000000051BC000-memory.dmpFilesize
624KB
-
memory/4220-142-0x0000000004B70000-0x0000000005114000-memory.dmpFilesize
5.6MB
-
memory/4220-145-0x0000000005240000-0x00000000052A6000-memory.dmpFilesize
408KB
-
memory/4220-146-0x0000000005610000-0x00000000056A2000-memory.dmpFilesize
584KB
-
memory/4220-147-0x0000000006C70000-0x0000000006C7A000-memory.dmpFilesize
40KB
-
memory/4220-148-0x0000000007E80000-0x0000000007ED0000-memory.dmpFilesize
320KB
-
memory/4300-137-0x0000000000000000-mapping.dmp
-
memory/4300-144-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB