Overview

overview

10

Static

static

8

kmd.exe

windows7_x64

10

kmd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8a32f65c4461c40f8f0f641c57c4fc7bec585dfc674138025c581079f1e5b7fe

  • Size

    1.8MB

  • Sample

    220524-wrv4zageaq

  • MD5

    2701390229f4549600dda5c490bd6808

  • SHA1

    4ed20d15f9b72ec7619f3132343104c0c975c27e

  • SHA256

    8a32f65c4461c40f8f0f641c57c4fc7bec585dfc674138025c581079f1e5b7fe

  • SHA512

    c1ed5ef7d65625a0d37faa1af5663a4b0ba096ecf3eeafbec9e2906421c7b629efe6404899b421ba426c226d4c026e81a40f7f80e71ca46e411fac941341eb3a

Score
10/10
massloggercollectionspywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.wolterfan.com
  • Port:
    587
  • Username:
    marketing2@wolterfan.com
  • Password:
    @Mar123

Targets

    • Target

      kmd.exe

    • Size

      1.8MB

    • MD5

      9906e3d9a42e2053405b72c9f85b0bad

    • SHA1

      06d5be5ef404c61a41d15bab8351aed6fb9ab310

    • SHA256

      13dd79b77c2ed2ba77d509e2d3b4621e83f7105674353f7e30930e07b099bce5

    • SHA512

      ad23480af230afb2fb447aee7386da6b106bc2b375c2270b3803526cd7e83eb5cea59469dab9bc21c099d809389ebd8dc0176bb6a357b45e473d9b6774e4a062

    Score
    10/10
    massloggercollectionspywarestealerupx

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks