masslogger | e06e5ba87ec0ed09101fcd62c238777c90c6a59be6bba4ced6890250948e6a4b

General

Target
m1pZYGiBFonndjG.exe
Size 1.0MB
Sample200709-9588lf1xvx
SHA256 e06e5ba87ec0ed09101fcd62c238777c90c6a59be6bba4ced6890250948e6a4b
MD5 5da5e488f088c67f1bc677baab5b75b8
SHA1 169b9253cfd6bfbf8a67e3e784b94e46dca4e58f
SHA512 038e377d4651f539e81d7cf05d68612b8c82661926695441cb3987eb4a8f8e812ef428d9a89fdd8928682a2369bd0b273286a29ed8f1ffa3b8890dcd848d51a6
MD5 SHA1 SHA512

Score

10^/10

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1344	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1344	1464	m1pZYGiBFonndjG.exe	26
PID 1464 wrote to memory of 1344	1464	m1pZYGiBFonndjG.exe	26
PID 1464 wrote to memory of 1344	1464	m1pZYGiBFonndjG.exe	26
PID 1464 wrote to memory of 1344	1464	m1pZYGiBFonndjG.exe	26
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28
PID 1464 wrote to memory of 1828	1464	m1pZYGiBFonndjG.exe	28

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1828	1464	m1pZYGiBFonndjG.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	m1pZYGiBFonndjG.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1828	m1pZYGiBFonndjG.exe

MassLogger log file 1 IoCs

Detects a log file produced by MassLogger.

yara_rule
masslogger_log_file

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1828	m1pZYGiBFonndjG.exe
1828	m1pZYGiBFonndjG.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1828	m1pZYGiBFonndjG.exe

C:\Users\Admin\AppData\Local\Temp\m1pZYGiBFonndjG.exe
"C:\Users\Admin\AppData\Local\Temp\m1pZYGiBFonndjG.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1464
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OBySigjDNKEBB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp319A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\m1pZYGiBFonndjG.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: AddClipboardFormatListener
  PID:1828