masslogger | 7deebb230f8cc6f9f4e5db778e5da101b2ff46241e41f534100ac914d29e0641

General

Target

PO450E0272.exe
Size

1.5MB
MD5

d874872ebcb2ce52f157bc13bcc0260d
SHA1

1be85e4d425820170f38a8fed3683648c3782a17
SHA256

7deebb230f8cc6f9f4e5db778e5da101b2ff46241e41f534100ac914d29e0641
SHA512

271338aaeaca49096fdafaff8a6102ee47e627081e68e3d556f2ee6239ae5295dd236fbfd447e70665d3ba34a1d4b70a3a8adf96f9191975400cdf41f990c6f2

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1584-15-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral2/memory/1584-16-0x0000000000481D6E-mapping.dmp	family_masslogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO450E0272.exe

description pid process target process

PID 3980 set thread context of 1584 3980 PO450E0272.exe MSBuild.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

MSBuild.exe

pid process

1584 MSBuild.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

MSBuild.exe

pid process

1584 MSBuild.exe
1584 MSBuild.exe
1584 MSBuild.exe
1584 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 1584 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

1584 MSBuild.exe

flow	ioc
24	api.ipify.org

description	pid	process	target process
PID 3980 set thread context of 1584	3980	PO450E0272.exe	MSBuild.exe

pid	process
1584	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1584	MSBuild.exe

pid	process
1584	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PO450E0272.exe

description	pid	process	target process
PID 3980 wrote to memory of 1584	3980	PO450E0272.exe	MSBuild.exe
PID 3980 wrote to memory of 1584	3980	PO450E0272.exe	MSBuild.exe
PID 3980 wrote to memory of 1584	3980	PO450E0272.exe	MSBuild.exe
PID 3980 wrote to memory of 1584	3980	PO450E0272.exe	MSBuild.exe
PID 3980 wrote to memory of 1584	3980	PO450E0272.exe	MSBuild.exe
PID 3980 wrote to memory of 1584	3980	PO450E0272.exe	MSBuild.exe
PID 3980 wrote to memory of 1584	3980	PO450E0272.exe	MSBuild.exe
PID 3980 wrote to memory of 1584	3980	PO450E0272.exe	MSBuild.exe

memory/1584-15-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1584-23-0x0000000007050000-0x0000000007051000-memory.dmp

Filesize
4KB

Download
memory/1584-22-0x0000000006850000-0x0000000006851000-memory.dmp

Filesize
4KB

Download
memory/1584-17-0x0000000073920000-0x000000007400E000-memory.dmp

Filesize
6.9MB

Download
memory/1584-16-0x0000000000481D6E-mapping.dmp

Download
memory/3980-7-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/3980-9-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/3980-10-0x0000000005530000-0x0000000005542000-memory.dmp

Filesize
72KB

Download
memory/3980-11-0x0000000006400000-0x00000000064F4000-memory.dmp

Filesize
976KB

Download
memory/3980-12-0x00000000059F0000-0x00000000059F8000-memory.dmp

Filesize
32KB

Download
memory/3980-14-0x0000000006200000-0x00000000062D6000-memory.dmp

Filesize
856KB

Download
memory/3980-8-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/3980-2-0x0000000073920000-0x000000007400E000-memory.dmp

Filesize
6.9MB

Download
memory/3980-6-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/3980-5-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/3980-3-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download