masslogger | 0d838e7b6343155a98bd1d15cab670ae29c0c20dd992c6f97f80d3791e1cbd14

General

Target

3710baf84c794fe82141d5baa97137ee.exe
Size

6.4MB
MD5

3710baf84c794fe82141d5baa97137ee
SHA1

5238b145897e6ba425e9bd8f889ed5f4bfbd5a7d
SHA256

0d838e7b6343155a98bd1d15cab670ae29c0c20dd992c6f97f80d3791e1cbd14
SHA512

77e39b14ef08844678b12722995a3ba3718e99a52b6bfe1fb011b29cf2c92a4a45746c858c7e8ecbbd7e3cc406ec15f07fc605f6c28997620e2e5b2b39c29ad1

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3748-8-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral2/memory/3748-9-0x0000000000481D3E-mapping.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3710baf84c794fe82141d5baa97137ee.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	3710baf84c794fe82141d5baa97137ee.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

3710baf84c794fe82141d5baa97137ee.exe

description pid process target process

PID 64 set thread context of 3748 64 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

3710baf84c794fe82141d5baa97137ee.exe

pid process

3748 3710baf84c794fe82141d5baa97137ee.exe

flow	ioc
13	api.ipify.org

description	pid	process	target process
PID 64 set thread context of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

3710baf84c794fe82141d5baa97137ee.exepowershell.exe

pid	process
3748	3710baf84c794fe82141d5baa97137ee.exe
3748	3710baf84c794fe82141d5baa97137ee.exe
3748	3710baf84c794fe82141d5baa97137ee.exe
3748	3710baf84c794fe82141d5baa97137ee.exe
2852	powershell.exe
2852	powershell.exe
2852	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3710baf84c794fe82141d5baa97137ee.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3748 3710baf84c794fe82141d5baa97137ee.exe
Token: SeDebugPrivilege 2852 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3710baf84c794fe82141d5baa97137ee.exe

pid process

3748 3710baf84c794fe82141d5baa97137ee.exe

description	pid	process
Token: SeDebugPrivilege	3748	3710baf84c794fe82141d5baa97137ee.exe
Token: SeDebugPrivilege	2852	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

3710baf84c794fe82141d5baa97137ee.exe3710baf84c794fe82141d5baa97137ee.exe

description	pid	process	target process
PID 64 wrote to memory of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe
PID 64 wrote to memory of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe
PID 64 wrote to memory of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe
PID 64 wrote to memory of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe
PID 64 wrote to memory of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe
PID 64 wrote to memory of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe
PID 64 wrote to memory of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe
PID 64 wrote to memory of 3748	64	3710baf84c794fe82141d5baa97137ee.exe	3710baf84c794fe82141d5baa97137ee.exe
PID 3748 wrote to memory of 2852	3748	3710baf84c794fe82141d5baa97137ee.exe	powershell.exe
PID 3748 wrote to memory of 2852	3748	3710baf84c794fe82141d5baa97137ee.exe	powershell.exe
PID 3748 wrote to memory of 2852	3748	3710baf84c794fe82141d5baa97137ee.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe
"C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:64

C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe
"C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3710baf84c794fe82141d5baa97137ee.exe.log
MD5
b23a44258e34da0c0a0fbdc97181e7ee

SHA1
3fd8043916912d002aafece52f663bae56b29b77

SHA256
6be1085554669fafc94a8c822d2c32c91b131ad281a9fb8745df3aadb0df4d9c

SHA512
6506ffd74612a82cbbdb89d8176e7406c0e936ede24837bdf2d1bd775cbd138c8e0e7742b774564d30c5dad737ba256e7a4f07718c1da35983054a78a2a0d90e

Download Submit
memory/64-3-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/64-5-0x0000000013070000-0x0000000013071000-memory.dmp

Filesize
4KB

Download
memory/64-6-0x0000000005780000-0x0000000005820000-memory.dmp

Filesize
640KB

Download
memory/64-7-0x0000000005DA0000-0x0000000005DA1000-memory.dmp

Filesize
4KB

Download
memory/64-2-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/2852-29-0x0000000007950000-0x0000000007951000-memory.dmp

Filesize
4KB

Download
memory/2852-24-0x0000000006B50000-0x0000000006B51000-memory.dmp

Filesize
4KB

Download
memory/2852-44-0x0000000008E50000-0x0000000008E51000-memory.dmp

Filesize
4KB

Download
memory/2852-42-0x0000000008E70000-0x0000000008E71000-memory.dmp

Filesize
4KB

Download
memory/2852-41-0x0000000008F10000-0x0000000008F11000-memory.dmp

Filesize
4KB

Download
memory/2852-17-0x0000000000000000-mapping.dmp

Download
memory/2852-18-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/2852-40-0x0000000008CF0000-0x0000000008CF1000-memory.dmp

Filesize
4KB

Download
memory/2852-20-0x0000000004130000-0x0000000004131000-memory.dmp

Filesize
4KB

Download
memory/2852-39-0x0000000008980000-0x0000000008981000-memory.dmp

Filesize
4KB

Download
memory/2852-23-0x0000000006BA0000-0x0000000006BA1000-memory.dmp

Filesize
4KB

Download
memory/2852-32-0x0000000008BA0000-0x0000000008BD3000-memory.dmp

Filesize
204KB

Download
memory/2852-25-0x0000000007240000-0x0000000007241000-memory.dmp

Filesize
4KB

Download
memory/2852-27-0x0000000007540000-0x0000000007541000-memory.dmp

Filesize
4KB

Download
memory/2852-28-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/2852-30-0x0000000007BF0000-0x0000000007BF1000-memory.dmp

Filesize
4KB

Download
memory/3748-8-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3748-11-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/3748-21-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/3748-19-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/3748-16-0x0000000006520000-0x0000000006521000-memory.dmp

Filesize
4KB

Download
memory/3748-14-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/3748-9-0x0000000000481D3E-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads