Analysis
-
max time kernel
133s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
27-06-2024 07:33
General
-
Target
09000000000000009.exe
-
Size
741KB
-
MD5
371f235c3625f124dee36379a46a8dba
-
SHA1
23e1fcb3503ee740cdc67c8045e9b7c8c1babec8
-
SHA256
ae1101f81ed495b405d0f80d678da0a6eff8e2f9c432734302ffb764b215de0a
-
SHA512
a83c28b39989754ec3fd6d76ab55fcbf37a3b4fedb141962f8aa7fae7d1b681d5b95d9db0cd56025549f71d18b7748a9852f324e0c1a1d6fe4dba1bfd2431ebb
-
SSDEEP
12288:ldCVE4Cn+bipNZmN0BueA63zIK48XqASE4zC1zmBVQEu9LPcfUdEkmrodF:jC9u8ifZmgueAGz4a6zC1UxoTQUa1ror
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
ihemeg1986
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 33 IoCs
-
Loads dropped DLL 2 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09000000000000009.exe"C:\Users\Admin\AppData\Local\Temp\09000000000000009.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\09000000000000009.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5d4cd2de76cb5e3926b6ebbdb5d421490
SHA19ba8904ab672d5761ff95c7db07ca249d000b0d0
SHA2564feb8ae08b605e9cd75f5a999c59cdb5b5ddc5dd6932b018ba0a4fa5ef6dd1d5
SHA5127acb5f7d6d204779ed5c232d8e5fc01cd7312f59631a68bd10944b221f3e45b573cefa61e236d977ce623e9d99f3ed3c5b64a8086cc6c30bd648eaabc36126e5
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
704KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
272KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
80KB