masslogger | 6a164f48d3ed08f48e0817b3e5fe2aa579a2c57e7c7c5ab49a38d7cbd3715ade

General

Target
316675ee932f3deec4d3eaa36347db03.exe
Size 870KB
Sample200925-16efwybe2a
SHA256 6a164f48d3ed08f48e0817b3e5fe2aa579a2c57e7c7c5ab49a38d7cbd3715ade
MD5 316675ee932f3deec4d3eaa36347db03
SHA1 c8db9092049f42be776ca2255caaeafccbe022d1
SHA512 ad62920a54508995e04cd97de87186d73e5c9a1af559a0257e43d9973b62c6d1c39a17813e196e625748f25a9ec30ad649446592060e81e5699d7182d3f896f3
MD5 SHA1 SHA512

Score

10^/10

Path

Ransom Note

<|| v2.1.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 9/25/2020 12:43:44 PM MassLogger Started: 9/25/2020 12:43:37 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\316675ee932f3deec4d3eaa36347db03.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| USB Spread ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger log file 1 IoCs

Detects a log file produced by MassLogger.

yara_rule
masslogger_log_file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\International\Geo\Nation	316675ee932f3deec4d3eaa36347db03.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1992	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2032	316675ee932f3deec4d3eaa36347db03.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	316675ee932f3deec4d3eaa36347db03.exe
Token: SeDebugPrivilege	2032	316675ee932f3deec4d3eaa36347db03.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	316675ee932f3deec4d3eaa36347db03.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1992	1440	316675ee932f3deec4d3eaa36347db03.exe	28
PID 1440 wrote to memory of 1992	1440	316675ee932f3deec4d3eaa36347db03.exe	28
PID 1440 wrote to memory of 1992	1440	316675ee932f3deec4d3eaa36347db03.exe	28
PID 1440 wrote to memory of 1992	1440	316675ee932f3deec4d3eaa36347db03.exe	28
PID 1440 wrote to memory of 2036	1440	316675ee932f3deec4d3eaa36347db03.exe	30
PID 1440 wrote to memory of 2036	1440	316675ee932f3deec4d3eaa36347db03.exe	30
PID 1440 wrote to memory of 2036	1440	316675ee932f3deec4d3eaa36347db03.exe	30
PID 1440 wrote to memory of 2036	1440	316675ee932f3deec4d3eaa36347db03.exe	30
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31
PID 1440 wrote to memory of 2032	1440	316675ee932f3deec4d3eaa36347db03.exe	31

C:\Users\Admin\AppData\Local\Temp\316675ee932f3deec4d3eaa36347db03.exe
"C:\Users\Admin\AppData\Local\Temp\316675ee932f3deec4d3eaa36347db03.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vjLIBvBS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF0D4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\316675ee932f3deec4d3eaa36347db03.exe
  "C:\Users\Admin\AppData\Local\Temp\316675ee932f3deec4d3eaa36347db03.exe"
  2⤵
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\316675ee932f3deec4d3eaa36347db03.exe
  "C:\Users\Admin\AppData\Local\Temp\316675ee932f3deec4d3eaa36347db03.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2032