masslogger | bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767 | Triage

Analysis

max time kernel
139s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-05-2022 15:19

Sharing

Report Analysis Logs

General

Target

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Size

822KB
MD5

2d6e2e5246a199facabc1e85710ffadf
SHA1

6646268d847037b42badf41a631ea60c523731c7
SHA256

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767
SHA512

fa9f81e77296884e39621a833727eeb413bcfb7972564ef7bdf834bfb3f0cb03c125b086c5c6e4db2e2dda66ce2f26527116bd4a45c9ada5377ebcec51b2dc3a

Score

10^/10

masslogger collection ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8236ADF044\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/24/2022 5:50:07 PM MassLogger Started: 5/24/2022 5:49:53 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exebac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs

Email Collection

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Key queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

description	pid	process	target process
PID 4928 set thread context of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4408 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

pid process

4692 bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

pid	process
4692	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
4692	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

description pid process

Token: SeDebugPrivilege 4692 bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

pid process

4692 bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

description	pid	process	target process
PID 4928 wrote to memory of 4408	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	schtasks.exe
PID 4928 wrote to memory of 4408	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	schtasks.exe
PID 4928 wrote to memory of 4408	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	schtasks.exe
PID 4928 wrote to memory of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
PID 4928 wrote to memory of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
PID 4928 wrote to memory of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
PID 4928 wrote to memory of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
PID 4928 wrote to memory of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
PID 4928 wrote to memory of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
PID 4928 wrote to memory of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
PID 4928 wrote to memory of 4692	4928	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

outlook_office_path 1 IoCs

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

outlook_win_path 1 IoCs

Processes:

bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe

C:\Users\Admin\AppData\Local\Temp\bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
"C:\Users\Admin\AppData\Local\Temp\bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ErhKIaN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6457.tmp"
2⤵
- Creates scheduled task(s)
PID:4408

C:\Users\Admin\AppData\Local\Temp\bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe
"{path}"
2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bac3ee462346b1c7a215087d1dee33366fc020632c719f7f6416b0f586bd4767.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6457.tmp

Download Submit
memory/4408-134-0x0000000000000000-mapping.dmp

Download
memory/4692-137-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4692-136-0x0000000000000000-mapping.dmp

Download
memory/4692-139-0x0000000005170000-0x00000000051D6000-memory.dmp

Filesize
408KB

Download
memory/4692-140-0x0000000006D40000-0x0000000006D4A000-memory.dmp

Filesize
40KB

Download
memory/4692-141-0x0000000007890000-0x00000000078E0000-memory.dmp

Filesize
320KB

Download
memory/4928-131-0x0000000005400000-0x000000000549C000-memory.dmp

Filesize
624KB

Download
memory/4928-130-0x00000000009D0000-0x0000000000AA4000-memory.dmp

Filesize
848KB

Download
memory/4928-132-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/4928-133-0x0000000007580000-0x0000000007B24000-memory.dmp

Filesize
5.6MB

Download