masslogger | f2e24302387d047b6a74793fbb985efc5cb1e0ac7a746f954d1d5b91babca2e0

Analysis

max time kernel
142s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDER INQUIRY.exe
Size 2.0MB
Sample201109-2dp8wh6ffs
SHA256 f2e24302387d047b6a74793fbb985efc5cb1e0ac7a746f954d1d5b91babca2e0
MD5 9daef97f45cce0b17902defd03db0f80
SHA1 5a8b3eff2079e52c8dad67afc8857cb4c7eee42c
SHA512 2c5aee92995bd35351abc8286201cfaa004bd43ed723d44690f30604f752698e8544b7014f0bff29e261799db2ffe7be34c7759f466d91158c5a8d1d16989043
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4076-1-0x00000000005F2BDE-mapping.dmp	family_masslogger
behavioral2/memory/4076-0-0x0000000000550000-0x00000000005F8000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 492 set thread context of 4076	492	NEW ORDER INQUIRY.exe	78

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
492	NEW ORDER INQUIRY.exe
492	NEW ORDER INQUIRY.exe
492	NEW ORDER INQUIRY.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
492	NEW ORDER INQUIRY.exe
492	NEW ORDER INQUIRY.exe
492	NEW ORDER INQUIRY.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 4076	492	NEW ORDER INQUIRY.exe	78
PID 492 wrote to memory of 4076	492	NEW ORDER INQUIRY.exe	78
PID 492 wrote to memory of 4076	492	NEW ORDER INQUIRY.exe	78
PID 492 wrote to memory of 4076	492	NEW ORDER INQUIRY.exe	78
PID 492 wrote to memory of 4076	492	NEW ORDER INQUIRY.exe	78
PID 4076 wrote to memory of 1404	4076	MSBuild.exe	80
PID 4076 wrote to memory of 1404	4076	MSBuild.exe	80
PID 4076 wrote to memory of 1404	4076	MSBuild.exe	80
PID 1404 wrote to memory of 3288	1404	cmd.exe	82
PID 1404 wrote to memory of 3288	1404	cmd.exe	82
PID 1404 wrote to memory of 3288	1404	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\NEW ORDER INQUIRY.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER INQUIRY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
      4⤵
      PID:3288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-0-0x0000000000550000-0x00000000005F8000-memory.dmp

Download

memory/4076-2-0x0000000072F40000-0x000000007362E000-memory.dmp

Download

memory/4076-3-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/4076-5-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/4076-6-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/4076-7-0x0000000004D80000-0x0000000004DBE000-memory.dmp

Download

memory/4076-8-0x0000000005030000-0x0000000005031000-memory.dmp

Download

memory/4076-9-0x0000000005140000-0x0000000005141000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads