masslogger | 866af826d2e3bc86c1624cf394da54bd9760c2499cd6582b5434dfd159a78e06

General

Target
Copy of Cheque.exe
Size 877KB
Sample201109-xqlm159aex
SHA256 866af826d2e3bc86c1624cf394da54bd9760c2499cd6582b5434dfd159a78e06
MD5 47bf8b17983cc2307a403ed3e07622d9
SHA1 ef456c5ab429a921af7a4255ed17675da13d47cc
SHA512 d0be12009057dbc0bf2f65b30db6f9dde3b7700134778a2f0290289874da1ed7be241747363c49e5cef0e7bab31911e83514439a95836ae9955a33b1f4a26516
MD5 SHA1 SHA512

Score

10^/10

masslogger evasion ransomware rezer0 spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\109933CE9F\Log.txt

masslogger

Ransom Note

################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/11/2020 3:02:48 AM MassLogger Started: 11/11/2020 3:02:44 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Copy of Cheque.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1400-12-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/1400-13-0x00000000004A2CCE-mapping.dmp	family_masslogger

MassLogger log file 1 IoCs

Detects a log file produced by MassLogger.

yara_rule
masslogger_log_file

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral2/memory/4796-8-0x00000000070E0000-0x0000000007189000-memory.dmp	rezer0

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Copy of Cheque.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Copy of Cheque.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	Copy of Cheque.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Copy of Cheque.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Copy of Cheque.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 1400	4796	Copy of Cheque.exe	83

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1056	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1400	Copy of Cheque.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4796	Copy of Cheque.exe
4796	Copy of Cheque.exe
4796	Copy of Cheque.exe
4796	Copy of Cheque.exe
4796	Copy of Cheque.exe
4796	Copy of Cheque.exe
4796	Copy of Cheque.exe
1400	Copy of Cheque.exe
1400	Copy of Cheque.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	Copy of Cheque.exe
Token: SeDebugPrivilege	1400	Copy of Cheque.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1400	Copy of Cheque.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1056	4796	Copy of Cheque.exe	79
PID 4796 wrote to memory of 1056	4796	Copy of Cheque.exe	79
PID 4796 wrote to memory of 1056	4796	Copy of Cheque.exe	79
PID 4796 wrote to memory of 1316	4796	Copy of Cheque.exe	81
PID 4796 wrote to memory of 1316	4796	Copy of Cheque.exe	81
PID 4796 wrote to memory of 1316	4796	Copy of Cheque.exe	81
PID 4796 wrote to memory of 1332	4796	Copy of Cheque.exe	82
PID 4796 wrote to memory of 1332	4796	Copy of Cheque.exe	82
PID 4796 wrote to memory of 1332	4796	Copy of Cheque.exe	82
PID 4796 wrote to memory of 1400	4796	Copy of Cheque.exe	83
PID 4796 wrote to memory of 1400	4796	Copy of Cheque.exe	83
PID 4796 wrote to memory of 1400	4796	Copy of Cheque.exe	83
PID 4796 wrote to memory of 1400	4796	Copy of Cheque.exe	83
PID 4796 wrote to memory of 1400	4796	Copy of Cheque.exe	83
PID 4796 wrote to memory of 1400	4796	Copy of Cheque.exe	83
PID 4796 wrote to memory of 1400	4796	Copy of Cheque.exe	83
PID 4796 wrote to memory of 1400	4796	Copy of Cheque.exe	83

C:\Users\Admin\AppData\Local\Temp\Copy of Cheque.exe
"C:\Users\Admin\AppData\Local\Temp\Copy of Cheque.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRKwgmUT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF33F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\Copy of Cheque.exe
  "{path}"
  2⤵
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\Copy of Cheque.exe
  "{path}"
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\Copy of Cheque.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1400