masslogger | e8fedfa7d06811f116ce712ea9e2c96918bc4e168105e092354ebd5f708319b7

General

Target
Yugo_crypted(1).exe
Size 723KB
Sample201119-tddgcszeba
SHA256 e8fedfa7d06811f116ce712ea9e2c96918bc4e168105e092354ebd5f708319b7
MD5 41b64620129e5e081c51ddf461a4de97
SHA1 4f94803b05dd016407b933429e944f99dbcf6845
SHA512 18f4885a0f0bcd9311ddfdad15a9f6642bdc1c4575e43af3834d150be00856676048ec1e8c46f75dcb29b4c4a8a9c97bb064ebe3ec165bf8a0d7745b21116ddd
MD5 SHA1 SHA512

Score

10^/10

masslogger persistence spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 9 IoCs

resource	yara_rule
behavioral1/memory/1624-5-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/1624-6-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral1/memory/1624-7-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/1624-8-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/1624-15-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral1/memory/1624-16-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral1/memory/1624-17-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral1/memory/1624-18-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral1/memory/1624-14-0x0000000000486D0E-mapping.dmp	family_masslogger

ServiceHost packer 5 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral1/memory/1624-15-0x0000000000486D0E-mapping.dmp	servicehost
behavioral1/memory/1624-16-0x0000000000486D0E-mapping.dmp	servicehost
behavioral1/memory/1624-17-0x0000000000486D0E-mapping.dmp	servicehost
behavioral1/memory/1624-18-0x0000000000486D0E-mapping.dmp	servicehost
behavioral1/memory/1624-14-0x0000000000486D0E-mapping.dmp	servicehost

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names\Jg0VQf7t1k1AQIoEYp42zi6ZrOXoagHGMdTuZx0ptesAFBUTAIRDwZ3IOg1znsro8dPf4E00KHOhZKANOtvlllbinXalwUHWZsHVfyyDroB5Zb45APefWE = "288"	Yugo_crypted(1).exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 288 set thread context of 1624	288	Yugo_crypted(1).exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
400	1624	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
288	Yugo_crypted(1).exe
288	Yugo_crypted(1).exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	288	Yugo_crypted(1).exe
Token: SeDebugPrivilege	400	WerFault.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1548	288	Yugo_crypted(1).exe	29
PID 288 wrote to memory of 1548	288	Yugo_crypted(1).exe	29
PID 288 wrote to memory of 1548	288	Yugo_crypted(1).exe	29
PID 288 wrote to memory of 1548	288	Yugo_crypted(1).exe	29
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 288 wrote to memory of 1624	288	Yugo_crypted(1).exe	30
PID 1624 wrote to memory of 400	1624	Yugo_crypted(1).exe	31
PID 1624 wrote to memory of 400	1624	Yugo_crypted(1).exe	31
PID 1624 wrote to memory of 400	1624	Yugo_crypted(1).exe	31
PID 1624 wrote to memory of 400	1624	Yugo_crypted(1).exe	31

C:\Users\Admin\AppData\Local\Temp\Yugo_crypted(1).exe
"C:\Users\Admin\AppData\Local\Temp\Yugo_crypted(1).exe"
1⤵
- Modifies service
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288
- C:\Users\Admin\AppData\Local\Temp\Yugo_crypted(1).exe
  "{path}"
  2⤵
  PID:1548
- C:\Users\Admin\AppData\Local\Temp\Yugo_crypted(1).exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 620
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-0-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/288-1-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/288-3-0x00000000005E0000-0x00000000005F4000-memory.dmp

Download

memory/288-4-0x0000000008270000-0x0000000008320000-memory.dmp

Download

memory/400-19-0x00000000025E0000-0x00000000025F1000-memory.dmp

Download

memory/400-13-0x0000000000970000-0x0000000000981000-memory.dmp

Download

memory/1624-9-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/1624-8-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/1624-7-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/1624-5-0x0000000000400000-0x000000000048C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads