masslogger | 85729ea0b65a0a56b59f3e8ed961d4ce07f34804fb6b466b6d1c32e17cda4d8d

General

Target

Halkbank_Ekstre_20210111_074121_054441.pdf.exe
Size

1.2MB
MD5

d15100cd7db78e81557d5bdc4b4ffa39
SHA1

68b3327bd29d441095d088a10e1ec7fd189dce58
SHA256

85729ea0b65a0a56b59f3e8ed961d4ce07f34804fb6b466b6d1c32e17cda4d8d
SHA512

f1f7e41c07ca942d95854586056874ff84e042e3e7e99f8d874a1a79829609495107436a51c9784f0688fa6efc133d16052e5746794e1edf5c0c287ffc8f39e5

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/204-12-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral2/memory/204-13-0x0000000000481C1E-mapping.dmp	family_masslogger

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

3996 powershell.exe

pid	process
3996	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Halkbank_Ekstre_20210111_074121_054441.pdf.exe

description	pid	process	target process
PID 1628 set thread context of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Halkbank_Ekstre_20210111_074121_054441.pdf.exepowershell.exe

pid	process
204	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
204	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
3996	powershell.exe
3996	powershell.exe
3996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Halkbank_Ekstre_20210111_074121_054441.pdf.exeHalkbank_Ekstre_20210111_074121_054441.pdf.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
Token: SeDebugPrivilege	204	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
Token: SeDebugPrivilege	3996	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Halkbank_Ekstre_20210111_074121_054441.pdf.exeHalkbank_Ekstre_20210111_074121_054441.pdf.exe

description	pid	process	target process
PID 1628 wrote to memory of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
PID 1628 wrote to memory of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
PID 1628 wrote to memory of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
PID 1628 wrote to memory of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
PID 1628 wrote to memory of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
PID 1628 wrote to memory of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
PID 1628 wrote to memory of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
PID 1628 wrote to memory of 204	1628	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	Halkbank_Ekstre_20210111_074121_054441.pdf.exe
PID 204 wrote to memory of 3996	204	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	powershell.exe
PID 204 wrote to memory of 3996	204	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	powershell.exe
PID 204 wrote to memory of 3996	204	Halkbank_Ekstre_20210111_074121_054441.pdf.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210111_074121_054441.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210111_074121_054441.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210111_074121_054441.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210111_074121_054441.pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210111_074121_054441.pdf.exe'
3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank_Ekstre_20210111_074121_054441.pdf.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
memory/204-12-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/204-20-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/204-15-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/204-13-0x0000000000481C1E-mapping.dmp

Download
memory/1628-6-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/1628-9-0x0000000005930000-0x0000000005931000-memory.dmp

Filesize
4KB

Download
memory/1628-10-0x0000000005910000-0x0000000005922000-memory.dmp

Filesize
72KB

Download
memory/1628-11-0x0000000006640000-0x0000000006700000-memory.dmp

Filesize
768KB

Download
memory/1628-8-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/1628-7-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/1628-2-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/1628-5-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/1628-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/3996-21-0x0000000000000000-mapping.dmp

Download
memory/3996-22-0x00000000738C0000-0x0000000073FAE000-memory.dmp

Filesize
6.9MB

Download
memory/3996-23-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/3996-24-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

Filesize
4KB

Download
memory/3996-25-0x0000000006B80000-0x0000000006B81000-memory.dmp

Filesize
4KB

Download
memory/3996-26-0x0000000006D20000-0x0000000006D21000-memory.dmp

Filesize
4KB

Download
memory/3996-28-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/3996-29-0x00000000074D0000-0x00000000074D1000-memory.dmp

Filesize
4KB

Download
memory/3996-30-0x0000000007F40000-0x0000000007F41000-memory.dmp

Filesize
4KB

Download
memory/3996-31-0x0000000007D30000-0x0000000007D31000-memory.dmp

Filesize
4KB

Download
memory/3996-32-0x0000000009490000-0x0000000009491000-memory.dmp

Filesize
4KB

Download
memory/3996-33-0x0000000008A50000-0x0000000008A51000-memory.dmp

Filesize
4KB

Download
memory/3996-34-0x0000000008E10000-0x0000000008E11000-memory.dmp

Filesize
4KB

Download
memory/3996-35-0x00000000068D0000-0x00000000068D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads