masslogger | 31158724133cf00916cca2eb89ed79d453f1c9210cd79dbafaafcbc2eadba065

General

Target

kcfff.exe
Size

1.2MB
MD5

71e21f88a8027b66d18aefd18eb97da7
SHA1

2436535f99b2ecce872f60552742d845eeb75863
SHA256

31158724133cf00916cca2eb89ed79d453f1c9210cd79dbafaafcbc2eadba065
SHA512

3f8a32c729d470c94e085a98a0a2b3972a0682773fc51a8a65ce18d8861ea99c8177e13f448c1066627c750725938917c47d30f04a61fd9ce1505ac213cc2f5b

Score

10^/10

persistence spyware stealer masslogger

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

kcfff.exeportyu.exeInstallUtil.exe

pid process

1132 kcfff.exe
1132 kcfff.exe
1132 kcfff.exe
360 portyu.exe
360 portyu.exe
360 portyu.exe
1400 InstallUtil.exe

flow	ioc
3	api.ipify.org

pid	process
1132	kcfff.exe
1132	kcfff.exe
1132	kcfff.exe
360	portyu.exe
360	portyu.exe
360	portyu.exe
1400	InstallUtil.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

kcfff.execmd.exeportyu.exe

description	pid	process	target process
PID 1132 wrote to memory of 1504	1132	kcfff.exe	cmd.exe
PID 1132 wrote to memory of 1504	1132	kcfff.exe	cmd.exe
PID 1132 wrote to memory of 1504	1132	kcfff.exe	cmd.exe
PID 1132 wrote to memory of 1504	1132	kcfff.exe	cmd.exe
PID 1504 wrote to memory of 1612	1504	cmd.exe	reg.exe
PID 1504 wrote to memory of 1612	1504	cmd.exe	reg.exe
PID 1504 wrote to memory of 1612	1504	cmd.exe	reg.exe
PID 1504 wrote to memory of 1612	1504	cmd.exe	reg.exe
PID 1132 wrote to memory of 360	1132	kcfff.exe	portyu.exe
PID 1132 wrote to memory of 360	1132	kcfff.exe	portyu.exe
PID 1132 wrote to memory of 360	1132	kcfff.exe	portyu.exe
PID 1132 wrote to memory of 360	1132	kcfff.exe	portyu.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe
PID 360 wrote to memory of 1400	360	portyu.exe	InstallUtil.exe

Loads dropped DLL 2 IoCs

Processes:

kcfff.exeportyu.exe

pid process

1132 kcfff.exe
360 portyu.exe
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

kcfff.exeportyu.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 1132 kcfff.exe
Token: SeDebugPrivilege 360 portyu.exe
Token: SeDebugPrivilege 1400 InstallUtil.exe
Executes dropped EXE 2 IoCs

Processes:

portyu.exeInstallUtil.exe

pid process

360 portyu.exe
1400 InstallUtil.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

portyu.exe

description pid process target process

PID 360 set thread context of 1400 360 portyu.exe InstallUtil.exe

pid	process
1132	kcfff.exe
360	portyu.exe

yara_rule
masslogger_log_file

description	pid	process
Token: SeDebugPrivilege	1132	kcfff.exe
Token: SeDebugPrivilege	360	portyu.exe
Token: SeDebugPrivilege	1400	InstallUtil.exe

pid	process
360	portyu.exe
1400	InstallUtil.exe

description	pid	process	target process
PID 360 set thread context of 1400	360	portyu.exe	InstallUtil.exe

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\appd = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\portyu.exe"	reg.exe

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

C:\Users\Admin\AppData\Local\Temp\kcfff.exe
"C:\Users\Admin\AppData\Local\Temp\kcfff.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v appd /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\portyu.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v appd /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\portyu.exe"
3⤵
- Adds Run entry to start application
PID:1612

C:\Users\Admin\portyu.exe
"C:\Users\Admin\portyu.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:360

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Download Submit
C:\Users\Admin\portyu.exe

Download Submit
C:\Users\Admin\portyu.exe

Download Submit
\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Download Submit
\Users\Admin\portyu.exe

Download Submit
memory/360-6-0x0000000000000000-mapping.dmp

Download
memory/1132-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1400-14-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1400-15-0x00000000004945DE-mapping.dmp

Download
memory/1400-17-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1400-18-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1504-3-0x0000000000000000-mapping.dmp

Download
memory/1612-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing