Overview

overview

10

Static

static

EO09844Y4Y4.exe

windows7_x64

10

EO09844Y4Y4.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    125s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    13-06-2022 11:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    EO09844Y4Y4.exe

  • Size

    1.2MB

  • MD5

    10d01d4cd2c896a5573c90465dd6548f

  • SHA1

    365c81314ba3c23717734efaa78ec5844d37a9b2

  • SHA256

    30e4bf20932ff913f614d755aa681f3db76cbaf5c6ec08bd668459fab2bf9277

  • SHA512

    9b4b7dbfd8203353cf24f8ef73f1c0078b8a663a2282dc848b4fa1aeb3e3da7ee5f92b10617146627c729501e59237075cc5f8b791c43c556dac9939aa1c7cd3

Score
10/10
massloggercollectionevasionspywarestealer

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main Payload 6 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe
    "C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1960
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kiaPwNpyAy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC208.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:724
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kiaPwNpyAy.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:844
    • C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe
      "C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"
      2⤵
        PID:1848
      • C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe
        "C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"
        2⤵
        • Checks computer location settings
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1588

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpC208.tmp
      Filesize

      1KB

      MD5

      30981acccfc4b4cc1678ffb42392d974

      SHA1

      0783cd7d345aecef9401098a4b0e10ed29fa2910

      SHA256

      2de5f1b4e488a9ff00fcefa6b9b100c30a407b17e7437c0a228f0d1ffa9caa1d

      SHA512

      74a12634b7f2ed6b8d19c81ca63eca91f8c1635924df5789bc7b8d2cac461056b4ed5c9e86d4a2ce96e94b18b1dde5cb71ec22824b642978074ce3bb7457720e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      001680398ab6fcbbeae9c9f925ffddee

      SHA1

      9a5cce3f6cda9e610198dffa11d44a4c55f2dedb

      SHA256

      7ec0c0ba5e54040d6c89af67149951e629c68f37d6c969c60bdb7185a1451a9a

      SHA512

      5a95b2f81f95eac9c71cc4dcf752419fce5ef155c605ff46607d02cb12fcab28c3b5689edbe8028a5257ff4f3861a173512705841c43ee705a6bbeb2e35fbfd8

      Download Submit

    • memory/784-54-0x0000000000FC0000-0x0000000001104000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/784-55-0x0000000076391000-0x0000000076393000-memory.dmp

      Filesize

      8KB

      Download

    • memory/784-56-0x00000000003A0000-0x00000000003B2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/784-57-0x0000000005270000-0x000000000533E000-memory.dmp

      Filesize

      824KB

      Download

    • memory/844-80-0x000000006F360000-0x000000006F90B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/844-78-0x000000006F360000-0x000000006F90B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1588-68-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1588-69-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1588-65-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1588-70-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1588-73-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1588-75-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1588-64-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1588-81-0x0000000004E25000-0x0000000004E36000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1960-77-0x000000006F360000-0x000000006F90B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1960-79-0x000000006F360000-0x000000006F90B000-memory.dmp

      Filesize

      5.7MB

      Download