masslogger | d7f723006bca775ea723bcb6af0415357efe543e37791d2997b5100f4c775708

General

Target

ccccccccc.exe
Size

1.0MB
MD5

5404e7a2a261dde6b556c56a6afdb0ff
SHA1

de1806df710988013a36e28ee81c5ad42cc8dbf4
SHA256

d7f723006bca775ea723bcb6af0415357efe543e37791d2997b5100f4c775708
SHA512

21c2c72ea2a5b30573e2e1089d8a9c5e8f2d44002b04ddd6c9542413227f5acb228f167eb1720db122bfb6690141a5f444017388510f5c54d46c6bbc175fc13b

Score

10^/10

ransomware spyware stealer masslogger

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/8/2020 8:21:25 AM MassLogger Started: 7/8/2020 8:21:21 AM Interval: 1 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\ccccccccc.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1116	ccccccccc.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1116	ccccccccc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1116-2-0x0000000000400000-0x0000000000564000-memory.dmp	upx
behavioral1/memory/1116-4-0x0000000000400000-0x0000000000564000-memory.dmp	upx
behavioral1/memory/1116-5-0x0000000000400000-0x0000000000564000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 1116	1100	ccccccccc.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	ccccccccc.exe

MassLogger log file 1 IoCs

Detects a log file produced by MassLogger.

yara_rule
masslogger_log_file

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ccccccccccc.vbs	notepad.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1100	ccccccccc.exe
1116	ccccccccc.exe
1116	ccccccccc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1256	1100	ccccccccc.exe	24
PID 1100 wrote to memory of 1256	1100	ccccccccc.exe	24
PID 1100 wrote to memory of 1256	1100	ccccccccc.exe	24
PID 1100 wrote to memory of 1256	1100	ccccccccc.exe	24
PID 1100 wrote to memory of 1256	1100	ccccccccc.exe	24
PID 1100 wrote to memory of 1256	1100	ccccccccc.exe	24
PID 1100 wrote to memory of 1116	1100	ccccccccc.exe	25
PID 1100 wrote to memory of 1116	1100	ccccccccc.exe	25
PID 1100 wrote to memory of 1116	1100	ccccccccc.exe	25
PID 1100 wrote to memory of 1116	1100	ccccccccc.exe	25

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1100	ccccccccc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

C:\Users\Admin\AppData\Local\Temp\ccccccccc.exe
"C:\Users\Admin\AppData\Local\Temp\ccccccccc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1100
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:1256
- C:\Users\Admin\AppData\Local\Temp\ccccccccc.exe
  "C:\Users\Admin\AppData\Local\Temp\ccccccccc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-2-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/1116-4-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/1116-5-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/1116-6-0x0000000001FB0000-0x0000000002058000-memory.dmp

Filesize
672KB

Download
memory/1116-7-0x0000000001D92000-0x0000000001D93000-memory.dmp

Filesize
4KB

Download
memory/1116-8-0x0000000001DA0000-0x0000000001E42000-memory.dmp

Filesize
648KB

Download
memory/1256-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing