masslogger | 85bebb4da660f33be5aefd120cf7e715f76d22d87fc9334413f0061f1a238fa5

General

Target
tmpjvwoc5ur.js
Size 8.5MB
Sample260702-rseq6afy7z
SHA256 85bebb4da660f33be5aefd120cf7e715f76d22d87fc9334413f0061f1a238fa5
MD5 abfd77f13c92d8748e37558ecb3db828
SHA1 15c2d2b96830c529d0479061e99a244a430da360
SHA512 e9dcdf42a9690c5155485e60a1af77b2db1556dc9226fee9b415b292a59f60e10d37131329793bb615ee1702be554f663b2d7309249b9137f7e45df165dbc14f
SSDEEP 3072:jp8Gqo2IYanVsM+nrT6W22q13CEB78GDGRnaOyyAic2A/f24tIDLlFUCpvnXFRH/:ejHNg8u68p1jC
TLSH
T1CE961B2DBBEE015C9C26D386EAF151E4C5ACB92203DF651F80765ECE5312386D93226F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion execution masslogger persistence spyware stealer

Malware Config

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
00-00-0000
host_password
sR%x,ch*U#=b
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
mail.tremisa.com.mx
ssl_slate
False

Signatures

Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4808	powershell.exe
3	4808	powershell.exe
5	4808	powershell.exe
6	4808	powershell.exe
8	4808	powershell.exe
9	4808	powershell.exe
10	4808	powershell.exe
11	4808	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\v7755\\v2054.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	reallyfreegeoip.org
11	reallyfreegeoip.org
1	checkip.dyndns.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4808	powershell.exe
4808	powershell.exe
4808	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3732	1292	wscript.exe	80
PID 3732 wrote to memory of 4808	3732	conhost.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\tmpjvwoc5ur.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -w h -NOP -noni -EncodedCommand JgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABlAG4AdgA6AHYAWABwAG4AVQAzADgAVQB6AEwAWQBtADAAMgBMACkAKQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w h -NOP -noni -EncodedCommand JgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABlAG4AdgA6AHYAWABwAG4AVQAzADgAVQB6AEwAWQBtADAAMgBMACkAKQA=
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vnaf3x0l.jvj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vnaf3x0l.jvj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4808-0-0x000002CE528E0000-0x000002CE528F0000-memory.dmp

Download

memory/4808-1-0x000002CE528E0000-0x000002CE528F0000-memory.dmp

Download

memory/4808-2-0x000002CE56070000-0x000002CE56092000-memory.dmp

Download

memory/4808-9-0x000002CE52C70000-0x000002CE52E22000-memory.dmp

Download

memory/4808-10-0x000002CE52B10000-0x000002CE52B66000-memory.dmp

Download

memory/4808-13-0x000002CE52B70000-0x000002CE52B8E000-memory.dmp

Download

memory/4808-14-0x000002CE528E0000-0x000002CE528F0000-memory.dmp

Download

memory/4808-15-0x000002CE528E0000-0x000002CE528F0000-memory.dmp

Download

memory/4808-17-0x000002CE52BF0000-0x000002CE52C40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads