Analysis
-
max time kernel
79s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 15:30
Static task
static1
Behavioral task
behavioral1
Sample
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe
Resource
win10v2004-20220414-en
General
-
Target
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe
-
Size
994KB
-
MD5
87b19be58879f1fc7052851a1a9192ff
-
SHA1
ec586f8577f60677e9fc2ca9fe53174169f19c60
-
SHA256
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45
-
SHA512
1fcab9718ba6b2011e50a64ce59b03cb8a69cb523d4ad7dac56b1bc9e95740da38cab01311c0e591e341dfd8e87f040dbe00b21e95077c19172b770bde9b0cc7
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
info@aksayyanggin.com - Password:
1234567890$$
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
Processes:
RegAsm.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegAsm.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RegAsm.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegAsm.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ArzQT = "C:\\TBHNEBSE\\ArzQTu\\ArzQTujHU.vbs" 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exedescription pid process target process PID 852 set thread context of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
RegAsm.exepid process 1004 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 1004 RegAsm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exepid process 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1004 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1004 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exedescription pid process target process PID 852 wrote to memory of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe PID 852 wrote to memory of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe PID 852 wrote to memory of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe PID 852 wrote to memory of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe PID 852 wrote to memory of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe PID 852 wrote to memory of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe PID 852 wrote to memory of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe PID 852 wrote to memory of 1004 852 27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe RegAsm.exe -
outlook_office_path 1 IoCs
Processes:
RegAsm.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
outlook_win_path 1 IoCs
Processes:
RegAsm.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe"C:\Users\Admin\AppData\Local\Temp\27938e39910afbdc569c8a629736b4c0bbfdf2573d01d12664bf05661074df45.exe"1⤵
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegAsm.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-54-0x00000000001E0000-0x00000000002DE000-memory.dmpFilesize
1016KB
-
memory/852-55-0x0000000004BA0000-0x0000000004C9A000-memory.dmpFilesize
1000KB
-
memory/852-56-0x0000000004390000-0x000000000444E000-memory.dmpFilesize
760KB
-
memory/852-58-0x0000000001FA0000-0x0000000001FA3000-memory.dmpFilesize
12KB
-
memory/1004-57-0x00000000004A1B3E-mapping.dmp
-
memory/1004-59-0x0000000076781000-0x0000000076783000-memory.dmpFilesize
8KB
-
memory/1004-60-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1004-61-0x0000000005220000-0x0000000005264000-memory.dmpFilesize
272KB