masslogger | 1e003aa6499e75fcb47a0288d1e43b523b13b394bb8b692eae0b314a124d6f26

General

Target

SQ-107840 ecola.exe
Size

534KB
MD5

518f6ed1cbce45a852df7606e708e409
SHA1

2821a319fbfb2dd492b06ea26b444bbf225abad3
SHA256

1e003aa6499e75fcb47a0288d1e43b523b13b394bb8b692eae0b314a124d6f26
SHA512

18e4668eeb73182efdaa8b6eeaac96a70bb7f311c7baac6b0915bb8d34a4e9b618dd2916f8df822a30209c1c1aa64a46a5fefa1cb0f82611187065b281d2c274

Score

10^/10

masslogger persistence spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3404-8-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral2/memory/3404-9-0x000000000048701E-mapping.dmp	family_masslogger
behavioral2/memory/3404-14-0x000000000048701E-mapping.dmp	family_masslogger
behavioral2/memory/3404-15-0x000000000048701E-mapping.dmp	family_masslogger
behavioral2/memory/3404-16-0x000000000048701E-mapping.dmp	family_masslogger
behavioral2/memory/3404-17-0x000000000048701E-mapping.dmp	family_masslogger
behavioral2/memory/3404-18-0x000000000048701E-mapping.dmp	family_masslogger

ServiceHost packer 5 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/3404-14-0x000000000048701E-mapping.dmp	servicehost
behavioral2/memory/3404-15-0x000000000048701E-mapping.dmp	servicehost
behavioral2/memory/3404-16-0x000000000048701E-mapping.dmp	servicehost
behavioral2/memory/3404-17-0x000000000048701E-mapping.dmp	servicehost
behavioral2/memory/3404-18-0x000000000048701E-mapping.dmp	servicehost

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SQ-107840 ecola.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlcc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlcc.exe\""	SQ-107840 ecola.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SQ-107840 ecola.exe

description pid process target process

PID 580 set thread context of 3404 580 SQ-107840 ecola.exe SQ-107840 ecola.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3916 3404 WerFault.exe SQ-107840 ecola.exe

description	pid	process	target process
PID 580 set thread context of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe

pid	pid_target	process	target process
3916	3404	WerFault.exe	SQ-107840 ecola.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SQ-107840 ecola.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	580	SQ-107840 ecola.exe
Token: SeRestorePrivilege	3916	WerFault.exe
Token: SeBackupPrivilege	3916	WerFault.exe
Token: SeDebugPrivilege	3916	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SQ-107840 ecola.exe

description	pid	process	target process
PID 580 wrote to memory of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 580 wrote to memory of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 580 wrote to memory of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 580 wrote to memory of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 580 wrote to memory of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 580 wrote to memory of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 580 wrote to memory of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe
PID 580 wrote to memory of 3404	580	SQ-107840 ecola.exe	SQ-107840 ecola.exe

C:\Users\Admin\AppData\Local\Temp\SQ-107840 ecola.exe
"C:\Users\Admin\AppData\Local\Temp\SQ-107840 ecola.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\SQ-107840 ecola.exe
"C:\Users\Admin\AppData\Local\Temp\SQ-107840 ecola.exe"
2⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 940
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-0-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/580-1-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/580-3-0x0000000005B60000-0x0000000005B61000-memory.dmp

Filesize
4KB

Download
memory/580-4-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/580-5-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/580-6-0x0000000008B40000-0x0000000008BDA000-memory.dmp

Filesize
616KB

Download
memory/580-7-0x0000000008C10000-0x0000000008C26000-memory.dmp

Filesize
88KB

Download
memory/3404-9-0x000000000048701E-mapping.dmp

Download
memory/3404-8-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3404-10-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/3404-14-0x000000000048701E-mapping.dmp

Download
memory/3404-15-0x000000000048701E-mapping.dmp

Download
memory/3404-16-0x000000000048701E-mapping.dmp

Download
memory/3404-17-0x000000000048701E-mapping.dmp

Download
memory/3404-18-0x000000000048701E-mapping.dmp

Download
memory/3916-13-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/3916-19-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads