masslogger | e8fedfa7d06811f116ce712ea9e2c96918bc4e168105e092354ebd5f708319b7

General

Target
Yugo_crypted(1).exe
Size 723KB
Sample201119-tddgcszeba
SHA256 e8fedfa7d06811f116ce712ea9e2c96918bc4e168105e092354ebd5f708319b7
MD5 41b64620129e5e081c51ddf461a4de97
SHA1 4f94803b05dd016407b933429e944f99dbcf6845
SHA512 18f4885a0f0bcd9311ddfdad15a9f6642bdc1c4575e43af3834d150be00856676048ec1e8c46f75dcb29b4c4a8a9c97bb064ebe3ec165bf8a0d7745b21116ddd
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 7 IoCs

resource	yara_rule
behavioral2/memory/2136-10-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral2/memory/2136-11-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral2/memory/2136-20-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral2/memory/2136-19-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral2/memory/2136-22-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral2/memory/2136-21-0x0000000000486D0E-mapping.dmp	family_masslogger
behavioral2/memory/2136-23-0x0000000000486D0E-mapping.dmp	family_masslogger

ServiceHost packer 5 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/2136-20-0x0000000000486D0E-mapping.dmp	servicehost
behavioral2/memory/2136-19-0x0000000000486D0E-mapping.dmp	servicehost
behavioral2/memory/2136-22-0x0000000000486D0E-mapping.dmp	servicehost
behavioral2/memory/2136-21-0x0000000000486D0E-mapping.dmp	servicehost
behavioral2/memory/2136-23-0x0000000000486D0E-mapping.dmp	servicehost

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4048 set thread context of 2136	4048	Yugo_crypted(1).exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1176	2136	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4048	Yugo_crypted(1).exe
4048	Yugo_crypted(1).exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe
1176	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	Yugo_crypted(1).exe
Token: SeRestorePrivilege	1176	WerFault.exe
Token: SeBackupPrivilege	1176	WerFault.exe
Token: SeDebugPrivilege	1176	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3172	4048	Yugo_crypted(1).exe	78
PID 4048 wrote to memory of 3172	4048	Yugo_crypted(1).exe	78
PID 4048 wrote to memory of 3172	4048	Yugo_crypted(1).exe	78
PID 4048 wrote to memory of 2136	4048	Yugo_crypted(1).exe	79
PID 4048 wrote to memory of 2136	4048	Yugo_crypted(1).exe	79
PID 4048 wrote to memory of 2136	4048	Yugo_crypted(1).exe	79
PID 4048 wrote to memory of 2136	4048	Yugo_crypted(1).exe	79
PID 4048 wrote to memory of 2136	4048	Yugo_crypted(1).exe	79
PID 4048 wrote to memory of 2136	4048	Yugo_crypted(1).exe	79
PID 4048 wrote to memory of 2136	4048	Yugo_crypted(1).exe	79
PID 4048 wrote to memory of 2136	4048	Yugo_crypted(1).exe	79

C:\Users\Admin\AppData\Local\Temp\Yugo_crypted(1).exe
"C:\Users\Admin\AppData\Local\Temp\Yugo_crypted(1).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\Yugo_crypted(1).exe
  "{path}"
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\Yugo_crypted(1).exe
  "{path}"
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 940
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-24-0x0000000004830000-0x0000000004831000-memory.dmp

Download

memory/1176-16-0x0000000004100000-0x0000000004101000-memory.dmp

Download

memory/2136-13-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/2136-10-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/4048-4-0x0000000004960000-0x0000000004961000-memory.dmp

Download

memory/4048-9-0x00000000088B0000-0x00000000088B1000-memory.dmp

Download

memory/4048-3-0x0000000004F80000-0x0000000004F81000-memory.dmp

Download

memory/4048-8-0x00000000081E0000-0x0000000008290000-memory.dmp

Download

memory/4048-0-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/4048-5-0x0000000004950000-0x0000000004951000-memory.dmp

Download

memory/4048-7-0x0000000004C50000-0x0000000004C64000-memory.dmp

Download

memory/4048-6-0x0000000008380000-0x0000000008381000-memory.dmp

Download

memory/4048-1-0x0000000000070000-0x0000000000071000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads