Analysis
-
max time kernel
125s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
13-06-2022 11:29
General
-
Target
EO09844Y4Y4.exe
-
Size
1.2MB
-
MD5
10d01d4cd2c896a5573c90465dd6548f
-
SHA1
365c81314ba3c23717734efaa78ec5844d37a9b2
-
SHA256
30e4bf20932ff913f614d755aa681f3db76cbaf5c6ec08bd668459fab2bf9277
-
SHA512
9b4b7dbfd8203353cf24f8ef73f1c0078b8a663a2282dc848b4fa1aeb3e3da7ee5f92b10617146627c729501e59237075cc5f8b791c43c556dac9939aa1c7cd3
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 6 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kiaPwNpyAy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC208.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kiaPwNpyAy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"C:\Users\Admin\AppData\Local\Temp\EO09844Y4Y4.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC208.tmpFilesize
1KB
MD530981acccfc4b4cc1678ffb42392d974
SHA10783cd7d345aecef9401098a4b0e10ed29fa2910
SHA2562de5f1b4e488a9ff00fcefa6b9b100c30a407b17e7437c0a228f0d1ffa9caa1d
SHA51274a12634b7f2ed6b8d19c81ca63eca91f8c1635924df5789bc7b8d2cac461056b4ed5c9e86d4a2ce96e94b18b1dde5cb71ec22824b642978074ce3bb7457720e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5001680398ab6fcbbeae9c9f925ffddee
SHA19a5cce3f6cda9e610198dffa11d44a4c55f2dedb
SHA2567ec0c0ba5e54040d6c89af67149951e629c68f37d6c969c60bdb7185a1451a9a
SHA5125a95b2f81f95eac9c71cc4dcf752419fce5ef155c605ff46607d02cb12fcab28c3b5689edbe8028a5257ff4f3861a173512705841c43ee705a6bbeb2e35fbfd8
-
memory/724-60-0x0000000000000000-mapping.dmp
-
memory/784-54-0x0000000000FC0000-0x0000000001104000-memory.dmpFilesize
1.3MB
-
memory/784-55-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/784-56-0x00000000003A0000-0x00000000003B2000-memory.dmpFilesize
72KB
-
memory/784-57-0x0000000005270000-0x000000000533E000-memory.dmpFilesize
824KB
-
memory/844-80-0x000000006F360000-0x000000006F90B000-memory.dmpFilesize
5.7MB
-
memory/844-62-0x0000000000000000-mapping.dmp
-
memory/844-78-0x000000006F360000-0x000000006F90B000-memory.dmpFilesize
5.7MB
-
memory/1588-68-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1588-69-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1588-65-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1588-70-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1588-71-0x000000000048226E-mapping.dmp
-
memory/1588-73-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1588-75-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1588-64-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1588-81-0x0000000004E25000-0x0000000004E36000-memory.dmpFilesize
68KB
-
memory/1960-77-0x000000006F360000-0x000000006F90B000-memory.dmpFilesize
5.7MB
-
memory/1960-58-0x0000000000000000-mapping.dmp
-
memory/1960-79-0x000000006F360000-0x000000006F90B000-memory.dmpFilesize
5.7MB