masslogger | e97151ce51e9463bd45ad41571141614fc0ffc8a8cbf2c74f36c20028a769f41

General

Target
LIST OF PRODUCTS NEEDED.exe
Size 1.1MB
Sample201118-9cdmjv3e9n
SHA256 e97151ce51e9463bd45ad41571141614fc0ffc8a8cbf2c74f36c20028a769f41
MD5 af517807c4b6160d07314ba228f333de
SHA1 9020081ebc00595e57d5d40a742682f4de0b7671
SHA512 8647a9336ff7e33b60c7f9903d9214de5842bc195f4460870f9dda8205397ef9aaddf0a371ceb90b280e9b26017e53e0c10422844ce0f30fda14b7dccc310b00
MD5 SHA1 SHA512

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 7 IoCs

resource	yara_rule
behavioral2/memory/3764-0-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral2/memory/3764-1-0x00000000004872DE-mapping.dmp	family_masslogger
behavioral2/memory/3764-7-0x00000000004872DE-mapping.dmp	family_masslogger
behavioral2/memory/3764-8-0x00000000004872DE-mapping.dmp	family_masslogger
behavioral2/memory/3764-9-0x00000000004872DE-mapping.dmp	family_masslogger
behavioral2/memory/3764-10-0x00000000004872DE-mapping.dmp	family_masslogger
behavioral2/memory/3764-11-0x00000000004872DE-mapping.dmp	family_masslogger

ServiceHost packer 5 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/3764-7-0x00000000004872DE-mapping.dmp	servicehost
behavioral2/memory/3764-8-0x00000000004872DE-mapping.dmp	servicehost
behavioral2/memory/3764-9-0x00000000004872DE-mapping.dmp	servicehost
behavioral2/memory/3764-10-0x00000000004872DE-mapping.dmp	servicehost
behavioral2/memory/3764-11-0x00000000004872DE-mapping.dmp	servicehost

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 656 set thread context of 3764	656	LIST OF PRODUCTS NEEDED.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 188	656	LIST OF PRODUCTS NEEDED.exe	78
PID 656 wrote to memory of 188	656	LIST OF PRODUCTS NEEDED.exe	78
PID 656 wrote to memory of 188	656	LIST OF PRODUCTS NEEDED.exe	78
PID 656 wrote to memory of 3764	656	LIST OF PRODUCTS NEEDED.exe	79
PID 656 wrote to memory of 3764	656	LIST OF PRODUCTS NEEDED.exe	79
PID 656 wrote to memory of 3764	656	LIST OF PRODUCTS NEEDED.exe	79
PID 656 wrote to memory of 3764	656	LIST OF PRODUCTS NEEDED.exe	79
PID 656 wrote to memory of 3764	656	LIST OF PRODUCTS NEEDED.exe	79
PID 656 wrote to memory of 3764	656	LIST OF PRODUCTS NEEDED.exe	79
PID 656 wrote to memory of 3764	656	LIST OF PRODUCTS NEEDED.exe	79
PID 656 wrote to memory of 3764	656	LIST OF PRODUCTS NEEDED.exe	79
PID 3764 wrote to memory of 424	3764	RegSvcs.exe	80
PID 3764 wrote to memory of 424	3764	RegSvcs.exe	80
PID 3764 wrote to memory of 424	3764	RegSvcs.exe	80

C:\Users\Admin\AppData\Local\Temp\LIST OF PRODUCTS NEEDED.exe
"C:\Users\Admin\AppData\Local\Temp\LIST OF PRODUCTS NEEDED.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:188
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 688
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:424

memory/424-3-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/424-4-0x00000000029D0000-0x00000000029D1000-memory.dmp

Download

memory/424-5-0x00000000029D0000-0x00000000029D1000-memory.dmp

Download

memory/424-12-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Download

memory/3764-0-0x0000000000400000-0x000000000048C000-memory.dmp

Download