masslogger | 050500533700664d4dcf7439ae3367716abf404f390d4c94e95e3b00fa7f8fc4

General

Target
RFQ-09797-MQ0958-06-26-HYU-09687.js
Size 8.6MB
Sample260628-kgtmlsgv2k
SHA256 050500533700664d4dcf7439ae3367716abf404f390d4c94e95e3b00fa7f8fc4
MD5 13f1ecdb1c9e9b773192240fcb62400e
SHA1 b8b7ee49876aa5321b23d23a3832b83db1751026
SHA512 9419f53f7d3491de47ff661d343f28ff027a5477d082a0f4765cfade05db7e58a40ee13edb1566f9cbb7fa9df7c2798743da8c226264f008a4220facbaf752d1
SSDEEP 6144:SWXfOdiR/jl+LLeCH+PJ5LdemfllKMtXJQm33l:bfOdul+OTeullKKXJQO1
TLSH
T1BC962A6CFBAF4329B776D642B0C56827AD1F124117DB942C12B67ECE0727352E9B280D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion execution masslogger persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.spacaex.com
Port
587
Username
[email protected]
Password
uO;HAxW8XQ#UMjMv

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
00-00-0000
host_password
uO;HAxW8XQ#UMjMv
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
mail.spacaex.com
ssl_slate
True

Signatures

Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	4584	powershell.exe
15	4584	powershell.exe
26	4584	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	wscript.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\v420\\v6138.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	checkip.dyndns.org
14	reallyfreegeoip.org
15	reallyfreegeoip.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4584	powershell.exe
4584	powershell.exe
4584	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3848	3288	wscript.exe	90
PID 3848 wrote to memory of 4584	3848	conhost.exe	91

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ-09797-MQ0958-06-26-HYU-09687.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -W h -nOp -noNI -EncodedCommand JgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABlAG4AdgA6AEQAWQBlAEEARABmAEEAWgB0AFgARgBzACkAKQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -W h -nOp -noNI -EncodedCommand JgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABlAG4AdgA6AEQAWQBlAEEARABmAEEAWgB0AFgARgBzACkAKQA=
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_tylnlngj.wjg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tylnlngj.wjg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4584-0-0x0000027EAC7F0000-0x0000027EAC800000-memory.dmp

Download

memory/4584-1-0x0000027EA90E0000-0x0000027EA9102000-memory.dmp

Download

memory/4584-9-0x0000027EAC7F0000-0x0000027EAC800000-memory.dmp

Download

memory/4584-10-0x0000027EAC7F0000-0x0000027EAC800000-memory.dmp

Download

memory/4584-11-0x0000027EACC90000-0x0000027EACE42000-memory.dmp

Download

memory/4584-12-0x0000027EAC4D0000-0x0000027EAC526000-memory.dmp

Download

memory/4584-15-0x0000027EAC530000-0x0000027EAC54E000-memory.dmp

Download

memory/4584-16-0x0000027EACB70000-0x0000027EACBC0000-memory.dmp

Download

memory/4584-17-0x0000027EC7AA0000-0x0000027EC7C62000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads