masslogger | 7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f

General

Target
wBn3alSjAhQUdu5.exe
Size 1002KB
Sample200714-w6tec8ne5x
SHA256 7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f
MD5 6a9d67850b1e7768e65877a1aae6ffc6
SHA1 5667a805545fa50a203a5fd4dc01a3615b5bf646
SHA512 92c85a6f54b2c1607095af63c47b359e72eead1f58f69121bbfa9c76dd287d28a6ebdc4ff1cb71e7113fdffdf6559f3c95388b48328e53d1e0a6777b0d133f1c
MD5 SHA1 SHA512

Score

10^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1824	1092	wBn3alSjAhQUdu5.exe	26
PID 1092 wrote to memory of 1824	1092	wBn3alSjAhQUdu5.exe	26
PID 1092 wrote to memory of 1824	1092	wBn3alSjAhQUdu5.exe	26
PID 1092 wrote to memory of 1824	1092	wBn3alSjAhQUdu5.exe	26
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28
PID 1092 wrote to memory of 1756	1092	wBn3alSjAhQUdu5.exe	28

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 1756	1092	wBn3alSjAhQUdu5.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1756	wBn3alSjAhQUdu5.exe
1756	wBn3alSjAhQUdu5.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1756	wBn3alSjAhQUdu5.exe

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	wBn3alSjAhQUdu5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	wBn3alSjAhQUdu5.exe

MassLogger log file 1 IoCs

Detects a log file produced by MassLogger.

yara_rule
masslogger_log_file

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1824	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\wBn3alSjAhQUdu5.exe
"C:\Users\Admin\AppData\Local\Temp\wBn3alSjAhQUdu5.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1092
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XoQVYAE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp20A9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\wBn3alSjAhQUdu5.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1756