masslogger | 6077a9d47232d6bb6425891c5c71096e21e4f961fa4b882004c4574a23321ab9

General

Target

gunzipped.exe
Size

936KB
MD5

bbb0b33663055f506d0dc4fa382b6ef6
SHA1

c97788c492ebd0f959f069ab5b6d341fb2fbcaa1
SHA256

6077a9d47232d6bb6425891c5c71096e21e4f961fa4b882004c4574a23321ab9
SHA512

d4adf010dd558fb0f6a70b09c675c636dbe70be04e1495dfd7b113b0975141e0e891c1723837c1bae114a327cc056718934196b6ea9843839c23f16f78a144b6

Score

10^/10

ransomware spyware stealer masslogger

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\42EF15E83D\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/31/2020 2:14:14 PM MassLogger Started: 7/31/2020 2:14:06 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\gunzipped.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

gunzipped.exe

description pid process target process

PID 336 set thread context of 1940 336 gunzipped.exe gunzipped.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

gunzipped.exe

pid process

1940 gunzipped.exe
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

gunzipped.exegunzipped.exe

description pid process

Token: SeDebugPrivilege 336 gunzipped.exe
Token: SeDebugPrivilege 1940 gunzipped.exe

description	pid	process	target process
PID 336 set thread context of 1940	336	gunzipped.exe	gunzipped.exe

pid	process
1940	gunzipped.exe

yara_rule
masslogger_log_file

flow	ioc
5	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	336	gunzipped.exe
Token: SeDebugPrivilege	1940	gunzipped.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

gunzipped.exe

description	pid	process	target process
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe
PID 336 wrote to memory of 1940	336	gunzipped.exe	gunzipped.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

gunzipped.exe

pid process

1940 gunzipped.exe
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

gunzipped.exegunzipped.exe

pid process

336 gunzipped.exe
336 gunzipped.exe
1940 gunzipped.exe
1940 gunzipped.exe

pid	process
1940	gunzipped.exe

pid	process
336	gunzipped.exe
336	gunzipped.exe
1940	gunzipped.exe
1940	gunzipped.exe

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:336

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"{path}"
2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1940-2-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1940-3-0x00000000004B2DEE-mapping.dmp

Download
memory/1940-4-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1940-5-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing