masslogger | 420541ff7ab7f97d2110f9c2f2488087c0d2f9e577fa5e55c73eebf4f5416bbc

General

Target

purchase order.exe
Size

790KB
MD5

3c55253fc699ca4f3aa7b5f39796e82c
SHA1

85be2e70b90bbefdb191cd5440c9519772755402
SHA256

420541ff7ab7f97d2110f9c2f2488087c0d2f9e577fa5e55c73eebf4f5416bbc
SHA512

bedb39cfab073dfce9e12488818d20381e48ec33cbfe30c53f5e1679b439b261c65cbf448f1a6d616c74f337f0dbcfd70194b141abc2399eed703210e0b1e297

Score

10^/10

stealer spyware masslogger

Malware Config

Signatures

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

purchase order.exe

description pid process

Token: SeDebugPrivilege 1856 purchase order.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

purchase order.exe

description pid process target process

PID 1312 set thread context of 1856 1312 purchase order.exe purchase order.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

purchase order.exe

pid process

1856 purchase order.exe
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1820 schtasks.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

yara_rule
masslogger_log_file

flow	ioc
5	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	1856	purchase order.exe

description	pid	process	target process
PID 1312 set thread context of 1856	1312	purchase order.exe	purchase order.exe

pid	process
1856	purchase order.exe

pid	process
1820	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

purchase order.exe

description	pid	process	target process
PID 1312 wrote to memory of 1820	1312	purchase order.exe	schtasks.exe
PID 1312 wrote to memory of 1820	1312	purchase order.exe	schtasks.exe
PID 1312 wrote to memory of 1820	1312	purchase order.exe	schtasks.exe
PID 1312 wrote to memory of 1820	1312	purchase order.exe	schtasks.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe
PID 1312 wrote to memory of 1856	1312	purchase order.exe	purchase order.exe

C:\Users\Admin\AppData\Local\Temp\purchase order.exe
"C:\Users\Admin\AppData\Local\Temp\purchase order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iVrhdqTQlx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp729F.tmp"
2⤵
- Creates scheduled task(s)
PID:1820

C:\Users\Admin\AppData\Local\Temp\purchase order.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp729F.tmp

Download Submit
memory/1312-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1820-2-0x0000000000000000-mapping.dmp

Download
memory/1856-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1856-5-0x00000000004940BE-mapping.dmp

Download
memory/1856-6-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1856-7-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads