masslogger | 21ada34a203f6a238393d69d9c0aebc680f65e9eb0a9bc472f558709e85c88ee

General

Target
NmrW2PxJyGe6Cnm.exe
Size 1.1MB
Sample201010-mpakfldxb6
SHA256 21ada34a203f6a238393d69d9c0aebc680f65e9eb0a9bc472f558709e85c88ee
MD5 9a066cf26056abc4c49fc5f71e7531e4
SHA1 9ac775991f4a9f95a2f853043795adc4e518b46b
SHA512 8c2922a0533c11491f305f9da625981c9cc04997595c3c8bb9057ffd99b0e4c56fd6e8ce1ca7030daf4d18ae331ea750ac26fc9152e6b406fdc351d96d57c5ae
MD5 SHA1 SHA512

Score

10^/10

Credentials

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1572-8-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/1572-9-0x000000000048177E-mapping.dmp	family_masslogger
behavioral1/memory/1572-10-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/1572-11-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\International\Geo\Nation	NmrW2PxJyGe6Cnm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 1572	1436	NmrW2PxJyGe6Cnm.exe	30

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1620	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1572	NmrW2PxJyGe6Cnm.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	NmrW2PxJyGe6Cnm.exe
Token: SeDebugPrivilege	1572	NmrW2PxJyGe6Cnm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1572	NmrW2PxJyGe6Cnm.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1620	1436	NmrW2PxJyGe6Cnm.exe	28
PID 1436 wrote to memory of 1620	1436	NmrW2PxJyGe6Cnm.exe	28
PID 1436 wrote to memory of 1620	1436	NmrW2PxJyGe6Cnm.exe	28
PID 1436 wrote to memory of 1620	1436	NmrW2PxJyGe6Cnm.exe	28
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30
PID 1436 wrote to memory of 1572	1436	NmrW2PxJyGe6Cnm.exe	30

C:\Users\Admin\AppData\Local\Temp\NmrW2PxJyGe6Cnm.exe
"C:\Users\Admin\AppData\Local\Temp\NmrW2PxJyGe6Cnm.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jDRGtFWzPQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7BD4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\NmrW2PxJyGe6Cnm.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1572