Analysis
-
max time kernel
106s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 20:30
Static task
static1
Behavioral task
behavioral1
Sample
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe
Resource
win10v2004-20220901-en
General
-
Target
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe
-
Size
820KB
-
MD5
6e32f33a38ff5bfa5cd5883e9ea49b96
-
SHA1
3e3771a344d29ee1afd6a36d6360c0ed80ddb3ff
-
SHA256
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2
-
SHA512
12fdcb1e8f64bcbd2861ffa75631f291ef35c2418be6576dbb9995b9cec3d30b32bd4ed76409e9a80cbfd02a3dc01836fae72c886643009e50ba55000bde90dd
-
SSDEEP
12288:wsJIlwYGu9Qz1dJmKmq33ckBx2dtkrtGq23qFsAiMJ9kbX/JjNzERmsqWPjtVnD5:wTl7AdFmqfBMpZzMJejyRpPfnf1
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\0B7B20BDD4\Log.txt
masslogger
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1968-142-0x0000000000400000-0x00000000004A8000-memory.dmp family_masslogger -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 52 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exedescription pid process target process PID 1564 set thread context of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exepid process 1968 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exepid process 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 1968 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 1968 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exedescription pid process Token: SeDebugPrivilege 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe Token: SeDebugPrivilege 1968 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exepid process 1968 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exedescription pid process target process PID 1564 wrote to memory of 5080 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe schtasks.exe PID 1564 wrote to memory of 5080 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe schtasks.exe PID 1564 wrote to memory of 5080 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe schtasks.exe PID 1564 wrote to memory of 2644 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 2644 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 2644 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1072 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1072 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1072 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe PID 1564 wrote to memory of 1968 1564 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
outlook_office_path 1 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe -
outlook_win_path 1 IoCs
Processes:
67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe"C:\Users\Admin\AppData\Local\Temp\67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NERzax" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEACD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\67a7100bbf102bed2773f56abdb1f761d7255bdf21ddf0a80bd2e7ec316af6e2.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\tmpEACD.tmpFilesize
1KB
MD57c208d04b458d3574e64fb65e8e93fa1
SHA16b2369cb0ee592f238d6bd0da9eec4c8c44ea5bf
SHA256a85e61c3cb133e5df8d0a90688cde28a98bab4410b1abf766d8dbf0bef68c34a
SHA51288c1ba5b6e04b001de5d4c337e826c2e52caefed2544a23f0dd6a035644f8f22211bb690b8dc930058efe4739128a3f72266fee842bb2fb101c32fbc76300437
-
memory/1072-140-0x0000000000000000-mapping.dmp
-
memory/1564-135-0x0000000005060000-0x000000000506A000-memory.dmpFilesize
40KB
-
memory/1564-136-0x00000000088B0000-0x000000000894C000-memory.dmpFilesize
624KB
-
memory/1564-132-0x0000000000680000-0x0000000000754000-memory.dmpFilesize
848KB
-
memory/1564-134-0x0000000004FB0000-0x0000000005042000-memory.dmpFilesize
584KB
-
memory/1564-133-0x0000000005690000-0x0000000005C34000-memory.dmpFilesize
5.6MB
-
memory/1968-141-0x0000000000000000-mapping.dmp
-
memory/1968-142-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1968-144-0x00000000051F0000-0x0000000005256000-memory.dmpFilesize
408KB
-
memory/1968-145-0x0000000007D90000-0x0000000007DE0000-memory.dmpFilesize
320KB
-
memory/2644-139-0x0000000000000000-mapping.dmp
-
memory/5080-137-0x0000000000000000-mapping.dmp