masslogger | aa30ea6f5603484a2f71a0fa1429cef880ee018c6b3557ad09708dca055cbb22

General

Target
1LoggerBin.exe
Size 746KB
Sample200805-4tm99pxsc6
SHA256 aa30ea6f5603484a2f71a0fa1429cef880ee018c6b3557ad09708dca055cbb22
MD5 7f0c5f12fb35a4a5b57fc5d9653e9a36
SHA1 9ec93685793ec65e15fd25f25fae01aaa0510d1a
SHA512 394cb2cab5ee7143d26da2f0af1a1843d349c75b109d87c2b733c16b4f484c38eb5a08bddb0a8db45f165f9752b1bea5ab0633e9d870a0513c3c0c5876577c66
MD5 SHA1 SHA512

Score

10^/10

ransomware spyware stealer masslogger

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\480F96756F\Log.txt

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 8/5/2020 9:12:19 AM MassLogger Started: 8/5/2020 9:12:15 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\1LoggerBin.exe MassLogger Melt: true MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Downloader ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Signatures

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3180	1LoggerBin.exe
3180	1LoggerBin.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe
428	WerFault.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3180	1LoggerBin.exe

MassLogger log file 1 IoCs

Detects a log file produced by MassLogger.

yara_rule
masslogger_log_file

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	1LoggerBin.exe
Token: SeRestorePrivilege	428	WerFault.exe
Token: SeBackupPrivilege	428	WerFault.exe
Token: SeDebugPrivilege	428	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3180	1LoggerBin.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4004	3180	1LoggerBin.exe	68
PID 3180 wrote to memory of 4004	3180	1LoggerBin.exe	68
PID 3180 wrote to memory of 4004	3180	1LoggerBin.exe	68
PID 4004 wrote to memory of 628	4004	cmd.exe	70
PID 4004 wrote to memory of 628	4004	cmd.exe	70
PID 4004 wrote to memory of 628	4004	cmd.exe	70

Program crash 1 IoCs

pid	pid_target	Process	procid_target
428	628	WerFault.exe	70

ServiceHost packer 6 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/628-4-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/628-5-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/628-6-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/628-8-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/628-7-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/628-9-0x0000000000000000-mapping.dmp	servicehost

C:\Users\Admin\AppData\Local\Temp\1LoggerBin.exe
"C:\Users\Admin\AppData\Local\Temp\1LoggerBin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\1LoggerBin.exe' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\1LoggerBin.exe'
    3⤵
    PID:628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 708
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Program crash
      PID:428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-3-0x0000000004390000-0x0000000004391000-memory.dmp

Download

memory/428-10-0x0000000004AC0000-0x0000000004AC1000-memory.dmp