Analysis

  • max time kernel
    96s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2024 08:07

General

  • Target

    Document_028472.exe

  • Size

    905KB

  • MD5

    d82790a83761efb5c7727fb60db48723

  • SHA1

    0345bbca4671daf283f40b20fa477ed8a84ba9a4

  • SHA256

    f305b0d150fd1cae5ece3e13a86f95d7a4f25683930a57988878198b7f547ba4

  • SHA512

    bb835bb5a954e206a3605eebee9ecaa6986af0e8a222fcb8108eb62ca856b183c10f2c58efcad803a47aabf70122cfe288a484a76eced03d74d6a6a06615422d

  • SSDEEP

    12288:yFg3OaHjYaVymEzQSpHVNmLkS2i8fHLO2HyjJasQlYOUDhw0Gey7awQAtfDAvwIq:ZjYa5SHNU2XzPH8JHrC0LmawQnvw

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    m.gorecka@criiteo.com
  • Password:
    efforting@

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main payload 32 IoCs
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document_028472.exe
    "C:\Users\Admin\AppData\Local\Temp\Document_028472.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SUzUwFfZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2E8D.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3480
    • C:\Users\Admin\AppData\Local\Temp\Document_028472.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1476

Network

  • flag-us
    DNS
    79.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.190.18.2.in-addr.arpa
    IN PTR
    Response
    79.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-79deploystaticakamaitechnologiescom
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.190.18.2.in-addr.arpa
    IN PTR
    Response
    73.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    api.ipify.org
    Document_028472.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    172.67.74.152
  • flag-us
    GET
    http://api.ipify.org/
    Document_028472.exe
    Remote address:
    104.26.13.205:80
    Request
    GET / HTTP/1.1
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Fri, 27 Sep 2024 08:08:02 GMT
    Content-Type: text/plain
    Content-Length: 13
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 8c9a00e50b5e943c-LHR
  • flag-us
    DNS
    205.13.26.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.13.26.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    mail.privateemail.com
    Document_028472.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.privateemail.com
    IN A
    Response
    mail.privateemail.com
    IN A
    198.54.122.135
  • flag-us
    DNS
    135.122.54.198.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    135.122.54.198.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    69.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 104.26.13.205:80
    http://api.ipify.org/
    http
    Document_028472.exe
    339 B
    401 B
    6
    4

    HTTP Request

    GET http://api.ipify.org/

    HTTP Response

    200
  • 198.54.122.135:587
    mail.privateemail.com
    smtp-submission
    Document_028472.exe
    1.3kB
    7.0kB
    15
    24
  • 8.8.8.8:53
    79.190.18.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    79.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    73.190.18.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    73.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    api.ipify.org
    dns
    Document_028472.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.13.205
    104.26.12.205
    172.67.74.152

  • 8.8.8.8:53
    205.13.26.104.in-addr.arpa
    dns
    72 B
    134 B
    1
    1

    DNS Request

    205.13.26.104.in-addr.arpa

  • 8.8.8.8:53
    mail.privateemail.com
    dns
    Document_028472.exe
    67 B
    83 B
    1
    1

    DNS Request

    mail.privateemail.com

    DNS Response

    198.54.122.135

  • 8.8.8.8:53
    135.122.54.198.in-addr.arpa
    dns
    73 B
    153 B
    1
    1

    DNS Request

    135.122.54.198.in-addr.arpa

  • 8.8.8.8:53
    69.209.201.84.in-addr.arpa
    dns
    72 B
    132 B
    1
    1

    DNS Request

    69.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Document_028472.exe.log

    Filesize

    1KB

    MD5

    8ec831f3e3a3f77e4a7b9cd32b48384c

    SHA1

    d83f09fd87c5bd86e045873c231c14836e76a05c

    SHA256

    7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

    SHA512

    26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

  • C:\Users\Admin\AppData\Local\Temp\tmp2E8D.tmp

    Filesize

    1KB

    MD5

    4c73a996f3d863aed4cf9bd090b00821

    SHA1

    4671ea6c1a45e0a69c279a33c8cfd74a041acf10

    SHA256

    3393c824fffe4b060f3faf71aa06036febf803bacc2e455722d4f3cffdd7e4c0

    SHA512

    779fb721c46f2020228672a161f910bb6a6e618db4e5ca05e805c5839539ce60f0b54a51563ede007d2a9815f60cb611005be5d0416cefc77d1ecb38cba8b968

  • memory/1476-47-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-55-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-23-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-565-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-564-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-559-0x0000000007D70000-0x0000000007D84000-memory.dmp

    Filesize

    80KB

  • memory/1476-41-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-552-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-549-0x0000000008240000-0x0000000008290000-memory.dmp

    Filesize

    320KB

  • memory/1476-21-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-19-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-17-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-29-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-63-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-550-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-25-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-545-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-537-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-536-0x00000000054E0000-0x0000000005546000-memory.dmp

    Filesize

    408KB

  • memory/1476-39-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-61-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-59-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-57-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-533-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-54-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-51-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-14-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-45-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-43-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-534-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-535-0x0000000005230000-0x0000000005274000-memory.dmp

    Filesize

    272KB

  • memory/1476-38-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-33-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-32-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-27-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-49-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-36-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-70-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-68-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-80-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-78-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-76-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-74-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-72-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1476-66-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1844-7-0x0000000007340000-0x00000000073DC000-memory.dmp

    Filesize

    624KB

  • memory/1844-65-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1844-3-0x0000000004980000-0x0000000004A12000-memory.dmp

    Filesize

    584KB

  • memory/1844-10-0x0000000007960000-0x0000000007A18000-memory.dmp

    Filesize

    736KB

  • memory/1844-9-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1844-8-0x00000000750DE000-0x00000000750DF000-memory.dmp

    Filesize

    4KB

  • memory/1844-6-0x0000000004FF0000-0x0000000004FF8000-memory.dmp

    Filesize

    32KB

  • memory/1844-5-0x00000000750D0000-0x0000000075880000-memory.dmp

    Filesize

    7.7MB

  • memory/1844-4-0x0000000004A50000-0x0000000004A5A000-memory.dmp

    Filesize

    40KB

  • memory/1844-2-0x0000000005020000-0x00000000055C4000-memory.dmp

    Filesize

    5.6MB

  • memory/1844-1-0x0000000000010000-0x00000000000F8000-memory.dmp

    Filesize

    928KB

  • memory/1844-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.