masslogger | 9a5b97c3839722f52530a7e53d8e1059fc3fdf03daa032ada16d01708a39e4cc

General

Target
PR Ref DXB PR 22-26.vbs
Size 4.8MB
Sample260821-jn15laap21
SHA256 9a5b97c3839722f52530a7e53d8e1059fc3fdf03daa032ada16d01708a39e4cc
MD5 48217f1d8461f09faed4ccbb5ec163ef
SHA1 27cbd327e457e0aecb625524bc83bcfc0d9e9939
SHA512 3fcba0504c2a20fdd82895127ab5d32782a55c0b8f7fc625c062123a2448ed1000ad133da15d22390ff719530fbb87ba876d8cfae63cd5e88ec1682431a96691
SSDEEP 24576:pzcVYAZ1ypgLISKDPrpPNwPii2OjwxT6KgLH00MUEX8:vAYSaXJVM
TLSH
T17F3616ABC7EC4104F6F76F009E82431D407BFD6640BAA199A31149AD9775128FCAAF73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution masslogger persistence spyware stealer

Malware Config

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
00-00-0000
host_password
Vd4_wKiUILWQ*tRY
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
mail.trimnt.com
ssl_slate
True

Signatures

Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
50	4580	powershell.exe
61	4580	powershell.exe
66	4580	powershell.exe
85	4580	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4580	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	WScript.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
49	checkip.dyndns.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1352	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4580	powershell.exe
4580	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1976	1352	WScript.exe	101
PID 1976 wrote to memory of 4580	1976	conhost.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PR Ref DXB PR 22-26.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\6027CB49E\6027CB49E.ps1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\6027CB49E\6027CB49E.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4580

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Visual Basic

1

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6027CB49E.ps1

Path C:\Users\Admin\AppData\Local\Temp\6027CB49E\6027CB49E.ps1
Size 1KB
SHA256 2c27300ac3160b6ee8f19675fd28fac935367d4f33fa8cbf451640eaf56f5105
MD5 07388b75d1768c1d0ae92b0a5faa6edf
SHA1 4cdad0a4bbc1009eea78b1f37d0a8b83d7f36f1a
SHA512 e7cd15e6b5ca0cd13620aae35f4e6e9c643436acc0dac3d24d9ec9ed34b6a843ff5582af4c87cb9f5b4244cee4584c51151c280bf3441b1c9d535ba09646f5ab
TLSH
T11531FE2566C2E764C5AE8033EE63D68DD5B54E1CBE8FAB81F35AC414214924076ED3CA
MD5 SHA1 SHA512 TLSH

Submit Download

6027CB49Ea

Path C:\Users\Admin\AppData\Local\Temp\6027CB49E\6027CB49Ea
Size 360KB
SHA256 acbabed4d2ee903946d9f4e80e31c35c9cd4bff2ff7d62ccb6705007a5cc2719
MD5 6c0ee8029afe7bf026b978e971871599
SHA1 4cff244229f015e6756057957da99b1b1513a88a
SHA512 f8d5f0af4aa4be92bfee97d715de2fbccc44616d2a864a21c82ff0f6d864397d9862639ba2e94b9c464037b76b08ec74408df9ec670ea0ed3111690cd5d478c0
SSDEEP 6144:L5+qGKfrEDbmH384+n2HXb6KYjQpjgxhYS3A4aba4+myGVMw5hYCypv/8H:L5zGwUmHMJnlKYiE84ZmhpTyOH
TLSH
T1CF7423117E3AAF7C90604B3DA19B4EEF44A4C976FC434495DB93D83B211ABC362C85B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6027CB49Eb

Path C:\Users\Admin\AppData\Local\Temp\6027CB49E\6027CB49Eb
Size 360KB
SHA256 e8c99a8b65a967473e379dffcb013cab6212f5741d160d34ab47edf84927546f
MD5 aafc76faadb50581529305058acebe88
SHA1 dfaa33f353eeb4ad91e31c344efc09eaba510186
SHA512 b985ff86f6b4626cfde3ebed1a1dd76f877eac824e4aa19ba4db7a33e60006be8f43dcbdcc9b13dfab7bda5caf90be3305426544852c576584c33a5b16398a01
SSDEEP 6144:wgfgMnweKb7pPc2Q5p4QNIUcYI//eFY0sm+ueTXL6eicJsDLzlihHhCf6oLkfC0y:9IMgb79XfKIjY4Kym+fbAcJsvzyHof60
TLSH
T1CF7423CB06F04FD82964D2FA91DEBD4F92802D64807E71EB03DD68EAD29FF590921535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_y1j2auh4.wvm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1j2auh4.wvm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4580-4-0x000001C7C9B80000-0x000001C7C9BA2000-memory.dmp

Download

memory/4580-15-0x000001C7E4390000-0x000001C7E4540000-memory.dmp

Download

memory/4580-16-0x000001C7E4540000-0x000001C7E4598000-memory.dmp

Download

memory/4580-17-0x000001C7E4160000-0x000001C7E417E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads