masslogger | 1e003aa6499e75fcb47a0288d1e43b523b13b394bb8b692eae0b314a124d6f26

General

Target

SQ-107840 ecola.exe
Size

534KB
MD5

518f6ed1cbce45a852df7606e708e409
SHA1

2821a319fbfb2dd492b06ea26b444bbf225abad3
SHA256

1e003aa6499e75fcb47a0288d1e43b523b13b394bb8b692eae0b314a124d6f26
SHA512

18e4668eeb73182efdaa8b6eeaac96a70bb7f311c7baac6b0915bb8d34a4e9b618dd2916f8df822a30209c1c1aa64a46a5fefa1cb0f82611187065b281d2c274

Score

10^/10

masslogger persistence spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1736-6-0x000000000048701E-mapping.dmp	family_masslogger
behavioral1/memory/1736-5-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/1736-7-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/1736-8-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/1736-15-0x000000000048701E-mapping.dmp	family_masslogger
behavioral1/memory/1736-14-0x000000000048701E-mapping.dmp	family_masslogger
behavioral1/memory/1736-16-0x000000000048701E-mapping.dmp	family_masslogger
behavioral1/memory/1736-17-0x000000000048701E-mapping.dmp	family_masslogger
behavioral1/memory/1736-18-0x000000000048701E-mapping.dmp	family_masslogger

ServiceHost packer 5 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral1/memory/1736-15-0x000000000048701E-mapping.dmp	servicehost
behavioral1/memory/1736-14-0x000000000048701E-mapping.dmp	servicehost
behavioral1/memory/1736-16-0x000000000048701E-mapping.dmp	servicehost
behavioral1/memory/1736-17-0x000000000048701E-mapping.dmp	servicehost
behavioral1/memory/1736-18-0x000000000048701E-mapping.dmp	servicehost

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SQ-107840 ecola.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlcc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlcc.exe\""	SQ-107840 ecola.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SQ-107840 ecola.exe

description pid process target process

PID 288 set thread context of 1736 288 SQ-107840 ecola.exe SQ-107840 ecola.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1392 1736 WerFault.exe SQ-107840 ecola.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1392 WerFault.exe
1392 WerFault.exe
1392 WerFault.exe
1392 WerFault.exe
1392 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SQ-107840 ecola.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 288 SQ-107840 ecola.exe
Token: SeDebugPrivilege 1392 WerFault.exe

description	pid	process	target process
PID 288 set thread context of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe

pid	pid_target	process	target process
1392	1736	WerFault.exe	SQ-107840 ecola.exe

pid	process
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	288	SQ-107840 ecola.exe
Token: SeDebugPrivilege	1392	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

SQ-107840 ecola.exeSQ-107840 ecola.exe

description	pid	process	target process
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 288 wrote to memory of 1736	288	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 1736 wrote to memory of 1392	1736	SQ-107840 ecola.exe	WerFault.exe
PID 1736 wrote to memory of 1392	1736	SQ-107840 ecola.exe	WerFault.exe
PID 1736 wrote to memory of 1392	1736	SQ-107840 ecola.exe	WerFault.exe
PID 1736 wrote to memory of 1392	1736	SQ-107840 ecola.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SQ-107840 ecola.exe
"C:\Users\Admin\AppData\Local\Temp\SQ-107840 ecola.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288

C:\Users\Admin\AppData\Local\Temp\SQ-107840 ecola.exe
"C:\Users\Admin\AppData\Local\Temp\SQ-107840 ecola.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 620
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-0-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/288-1-0x0000000001200000-0x0000000001201000-memory.dmp

Filesize
4KB

Download
memory/288-3-0x0000000004FB0000-0x000000000504A000-memory.dmp

Filesize
616KB

Download
memory/288-4-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download
memory/1392-19-0x0000000002590000-0x00000000025A1000-memory.dmp

Filesize
68KB

Download
memory/1392-13-0x0000000002060000-0x0000000002071000-memory.dmp

Filesize
68KB

Download
memory/1392-12-0x0000000000000000-mapping.dmp

Download
memory/1736-9-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1736-8-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1736-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1736-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1736-15-0x000000000048701E-mapping.dmp

Download
memory/1736-14-0x000000000048701E-mapping.dmp

Download
memory/1736-16-0x000000000048701E-mapping.dmp

Download
memory/1736-17-0x000000000048701E-mapping.dmp

Download
memory/1736-18-0x000000000048701E-mapping.dmp

Download
memory/1736-6-0x000000000048701E-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads