Analysis
- max time kernel
107s - max time network
109s - platform
windows10_x64 - resource
win10v200722 - submitted
27/08/2020, 05:34
General
- Target 0FEE5AD74A1F6A5CF38332A743CE4246.exe
- Size 1.1MB
- Sample200827-2bwcd9jwhe
- SHA256 d2d83fb7446e0969d3ffab161cb2d258041c9c0e686de6dc978b334b444b0512
Malware Config
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0FEE5AD74A1F6A5CF38332A743CE4246.exe"C:\Users\Admin\AppData\Local\Temp\0FEE5AD74A1F6A5CF38332A743CE4246.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0FEE5AD74A1F6A5CF38332A743CE4246.exe"C:\Users\Admin\AppData\Local\Temp\0FEE5AD74A1F6A5CF38332A743CE4246.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4020-0-0x0000000073520000-0x0000000073C0E000-memory.dmp
memory/4020-1-0x00000000003C0000-0x00000000003C1000-memory.dmp
memory/4020-3-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/4020-4-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/4020-5-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/4020-6-0x0000000004D90000-0x0000000004D91000-memory.dmp
memory/4020-7-0x0000000005010000-0x0000000005011000-memory.dmp
memory/4020-8-0x0000000004DB0000-0x0000000004DBB000-memory.dmp
memory/4020-9-0x0000000005C10000-0x0000000005CEE000-memory.dmp
memory/4020-10-0x0000000005EA0000-0x0000000005F52000-memory.dmp
memory/4024-11-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-14-0x0000000073520000-0x0000000073C0E000-memory.dmp
memory/4024-17-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-19-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-18-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-20-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-21-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-22-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-23-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-24-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-25-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-26-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-28-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-27-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-29-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-30-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-31-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-32-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-33-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-34-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-35-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-36-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-37-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-38-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-39-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-40-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-41-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-42-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-43-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-44-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-45-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-46-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-47-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-48-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-49-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-50-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-51-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-53-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-52-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-54-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-55-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-56-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-57-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-58-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-59-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-60-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-61-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-62-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-63-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-64-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-65-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-66-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-68-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-67-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-69-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-70-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-71-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-72-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-73-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-74-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-75-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-76-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-77-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-78-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-79-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-80-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-81-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-82-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-83-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-84-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-85-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-86-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-87-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-89-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-88-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-90-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-91-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-92-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-93-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-94-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-95-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-96-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-97-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-98-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-99-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-100-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-101-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-102-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-103-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-104-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-105-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-106-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-107-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-108-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-109-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-110-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-111-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-112-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-113-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-114-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-115-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-116-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-118-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-117-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-119-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-120-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-121-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-122-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-123-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-124-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-125-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-127-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-126-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-128-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-129-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-130-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-131-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-132-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-133-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-134-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-135-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-136-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-137-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-138-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-139-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-140-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-141-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-142-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-143-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-144-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-145-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-146-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-147-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-148-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-149-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-150-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-151-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-152-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-153-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-154-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-155-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-156-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-157-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-158-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-159-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-160-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-161-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-162-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-163-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-164-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-165-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-166-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-167-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-168-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-169-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-170-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-171-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-172-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-173-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-174-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-175-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-176-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-177-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-178-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-179-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-180-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-181-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-182-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-183-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-184-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-185-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-187-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-186-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-188-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-189-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-190-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-191-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-192-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-193-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-194-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-195-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-196-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-197-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-198-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-199-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-200-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-201-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-202-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-203-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-204-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-205-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-206-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-207-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-208-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-209-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-210-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-211-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-212-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-213-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-214-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-215-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-216-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-217-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-218-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-219-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-220-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-221-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-222-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-223-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-224-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-225-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-226-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-227-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-228-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-229-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-230-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-231-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-232-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-233-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-234-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-235-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-236-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-237-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-238-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-239-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-240-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-241-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-242-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-243-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-244-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-245-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-246-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-247-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-248-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-249-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-250-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-252-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-251-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-253-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-254-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-255-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-256-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-257-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-258-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-259-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-260-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-261-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-262-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-263-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-264-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-265-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-266-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4024-269-0x0000000006380000-0x0000000006381000-memory.dmp
memory/4024-271-0x0000000006E90000-0x0000000006ECE000-memory.dmp
memory/4024-272-0x00000000078F0000-0x00000000078F1000-memory.dmp