masslogger | 09566b43ed2bfc7c75e430da0c041345cc4d91ec7fddb2a3f363d57aaab64437

General

Target
pmdt2egRhRSrXC1.exe
Size 1.3MB
Sample201106-pzffdraw76
SHA256 09566b43ed2bfc7c75e430da0c041345cc4d91ec7fddb2a3f363d57aaab64437
MD5 ea81ff558826b66dbf79da6135156898
SHA1 8da5867230be8993533853423c4c34e22f0ff9e9
SHA512 9aed22657e122f92aa837bfb43dd7fa67b48bdc5f604f1c94cf4b0b7bf97d378dd940b8bdf8374d615416044547d8a62ab0ffdbf415d29206cb38a736134ae19
MD5 SHA1 SHA512

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1612-7-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/1612-9-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/1612-8-0x000000000048146E-mapping.dmp	family_masslogger
behavioral1/memory/1612-10-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	pmdt2egRhRSrXC1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

Modify Existing Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names\ThG499YyoJc1YjQ3qGSSHRCPzPT3z9BuUQ0mVjFQFjxfclwbcrEFSUWYYbRy6LVvzvp8XbL6H2eZEph9RCbbGovYUfnwDHPCrNtRRhSNxZGsRwaPYYVmtn = "756"	pmdt2egRhRSrXC1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 756 set thread context of 1612	756	pmdt2egRhRSrXC1.exe	31

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
560	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1612	pmdt2egRhRSrXC1.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	pmdt2egRhRSrXC1.exe
Token: SeDebugPrivilege	1612	pmdt2egRhRSrXC1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1612	pmdt2egRhRSrXC1.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 560	756	pmdt2egRhRSrXC1.exe	29
PID 756 wrote to memory of 560	756	pmdt2egRhRSrXC1.exe	29
PID 756 wrote to memory of 560	756	pmdt2egRhRSrXC1.exe	29
PID 756 wrote to memory of 560	756	pmdt2egRhRSrXC1.exe	29
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31
PID 756 wrote to memory of 1612	756	pmdt2egRhRSrXC1.exe	31

C:\Users\Admin\AppData\Local\Temp\pmdt2egRhRSrXC1.exe
"C:\Users\Admin\AppData\Local\Temp\pmdt2egRhRSrXC1.exe"
1⤵
- Modifies service
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OWvIJArlIshi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7A00.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:560
- C:\Users\Admin\AppData\Local\Temp\pmdt2egRhRSrXC1.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1612