masslogger | a9a4bd2de434ba7cb210b0e8bc7374db4c6df7e0e94dac78c67f3dc97ddadc4f

General

Target

DHL_20201230,pdf.exe
Size

1.1MB
MD5

14fe2d5d95ec2fe9d8610f5e16c88428
SHA1

97d20decb09787cbf557207a49b309b31429244c
SHA256

a9a4bd2de434ba7cb210b0e8bc7374db4c6df7e0e94dac78c67f3dc97ddadc4f
SHA512

50096d3b5c84cade3b070e649557313692bd4f89af08aba07582c2ecfb54d0f2da35b98f4ad3ca2c8c072a0cffde8c2ac991bad42e73422327946f617e2ee07b

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2412-5-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral2/memory/2412-6-0x0000000000481D6E-mapping.dmp	family_masslogger
behavioral2/memory/2412-11-0x0000000000481D6E-mapping.dmp	family_masslogger
behavioral2/memory/2412-10-0x0000000000481D6E-mapping.dmp	family_masslogger
behavioral2/memory/2412-12-0x0000000000481D6E-mapping.dmp	family_masslogger
behavioral2/memory/2412-13-0x0000000000481D6E-mapping.dmp	family_masslogger
behavioral2/memory/2412-14-0x0000000000481D6E-mapping.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL_20201230,pdf.exe

description pid process target process

PID 4020 set thread context of 2412 4020 DHL_20201230,pdf.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dw20.exe

pid process

3584 dw20.exe
3584 dw20.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dw20.exe

description pid process

Token: SeRestorePrivilege 3584 dw20.exe
Token: SeBackupPrivilege 3584 dw20.exe

description	pid	process	target process
PID 4020 set thread context of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe

pid	process
3584	dw20.exe
3584	dw20.exe

description	pid	process
Token: SeRestorePrivilege	3584	dw20.exe
Token: SeBackupPrivilege	3584	dw20.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

DHL_20201230,pdf.exeMSBuild.exe

description	pid	process	target process
PID 4020 wrote to memory of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe
PID 4020 wrote to memory of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe
PID 4020 wrote to memory of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe
PID 4020 wrote to memory of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe
PID 4020 wrote to memory of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe
PID 4020 wrote to memory of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe
PID 4020 wrote to memory of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe
PID 4020 wrote to memory of 2412	4020	DHL_20201230,pdf.exe	MSBuild.exe
PID 2412 wrote to memory of 3584	2412	MSBuild.exe	dw20.exe
PID 2412 wrote to memory of 3584	2412	MSBuild.exe	dw20.exe
PID 2412 wrote to memory of 3584	2412	MSBuild.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2412

memory/2412-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2412-6-0x0000000000481D6E-mapping.dmp

Download
memory/2412-11-0x0000000000481D6E-mapping.dmp

Download
memory/2412-10-0x0000000000481D6E-mapping.dmp

Download
memory/2412-12-0x0000000000481D6E-mapping.dmp

Download
memory/2412-13-0x0000000000481D6E-mapping.dmp

Download
memory/2412-14-0x0000000000481D6E-mapping.dmp

Download
memory/3584-7-0x0000000000000000-mapping.dmp

Download
memory/3584-8-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/3584-9-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download