General

  • Target

    5196cc3a66a7b2578ca8d4cb4b240bcc7e9418e69f1d08406bea9b47ee7d1215

  • Size

    657KB

  • Sample

    220718-rjgjdsfbak

  • MD5

    ccd88bc8cc3aed57a4c0ecf2dbd2d872

  • SHA1

    2dbde77b2451bc3a5e4ea7a221536958ab580642

  • SHA256

    5196cc3a66a7b2578ca8d4cb4b240bcc7e9418e69f1d08406bea9b47ee7d1215

  • SHA512

    4b4edd47158c95aab412ba667e641e8882924f9f584803cef26bebd8b9d5f3ad048c01eed9aa95850eff7d98bbc939c2c8f685f8083a2aeb4948115ae767ca2d

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note
<|| v2.1.0.0 ||> User Name: Admin IP: 127.0.0.1 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/18/2022 4:16:06 PM MassLogger Started: 7/18/2022 4:15:51 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\New Order - AM2 PO 90664 (Panda Construction)-2020.pif.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| USB Spread ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\6BE418BA2E\Log.txt

Family

masslogger

Ransom Note
<|| v2.1.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/18/2022 4:16:10 PM MassLogger Started: 7/18/2022 4:16:06 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\New Order - AM2 PO 90664 (Panda Construction)-2020.pif.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Window Searcher ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Targets

    • Target

      New Order - AM2 PO 90664 (Panda Construction)-2020.pif.exe

    • Size

      964KB

    • MD5

      8f07c62a1e74f64f012b59554a1f321e

    • SHA1

      3a3969e3c350d138beb8f0461369884a03e29ca2

    • SHA256

      1babda8db79c5d785a60d3d2bd721a9cbcab037420c47bcb2bfbfdaad5797124

    • SHA512

      97d646ade99c874ac055c958096827e612f94733a31b76cfd9182ddc96836df803efcf045dc8a8576a5a2ee190d315698c73cfc616dcdad96ced73beb1af4450

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks