Overview

overview

10

Static

static

scan copy.exe

windows7_x64

10

scan copy.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scan copy.exe

  • Size

    859KB

  • Sample

    200817-ff3mkzmzfs

  • MD5

    54a3dd33e8b12aed84551a0fecaa4068

  • SHA1

    637e1d8791e758bcce7a77c18c3c2019105e70e1

  • SHA256

    fa1dd731e06f5a7470f45a3f09f0b39d2e236d022c9a9d6e52828e8214c5893e

  • SHA512

    ed3a361816805a4894eee14de6d9a32d4bc55e1ca8daac9fbb358f6881acbf590bb23b3cfeb8ef16625440bd13e69bad34d8de51a5599f407b94249752268418

Score
10/10
massloggerevasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\42EF15E83D\Log.txt

Family

masslogger

Ransom Note
<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 8/17/2020 7:36:17 PM MassLogger Started: 8/17/2020 7:36:12 PM Interval: 1 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\scan copy.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.nartaccess.com
  • Port:
    587
  • Username:
    info@nartaccess.com
  • Password:
    T4R3PxJ68GnJ

Targets

    • Target

      scan copy.exe

    • Size

      859KB

    • MD5

      54a3dd33e8b12aed84551a0fecaa4068

    • SHA1

      637e1d8791e758bcce7a77c18c3c2019105e70e1

    • SHA256

      fa1dd731e06f5a7470f45a3f09f0b39d2e236d022c9a9d6e52828e8214c5893e

    • SHA512

      ed3a361816805a4894eee14de6d9a32d4bc55e1ca8daac9fbb358f6881acbf590bb23b3cfeb8ef16625440bd13e69bad34d8de51a5599f407b94249752268418

    Score
    10/10
    ransomwarespywarestealermassloggerevasion

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks