masslogger | 755577c3823e7282582c80e58f4d0bbfb3f6ada39bc8c5746a2ede25fb24fb4e

General

Target

sample (copy).vbs
Size

868KB
MD5

9a4970c5db150a6a0bfc85a5cb626a05
SHA1

ffd56a1a06736bc8b46e1c1353a4810efe4b0b4b
SHA256

755577c3823e7282582c80e58f4d0bbfb3f6ada39bc8c5746a2ede25fb24fb4e
SHA512

38a6e342e0d5ae99c1188045ec4c20b779a6c2c5c5337b226332722e824bb3836c1eea4f66b3a010bd651413f8152d9d801b6ab74327affcd9f74aa5b5402d5d

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1340-12-0x000000001E7C0000-0x000000001E841000-memory.dmp	family_masslogger

Executes dropped EXE 2 IoCs

Processes:

gghhkk.exegghhkk.exe

pid process

2620 gghhkk.exe
1340 gghhkk.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

gghhkk.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation gghhkk.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 api.ipify.org
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

gghhkk.exe

pid process

1340 gghhkk.exe
1340 gghhkk.exe
1340 gghhkk.exe
1340 gghhkk.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

gghhkk.exe

description pid process

Token: SeDebugPrivilege 1340 gghhkk.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

gghhkk.exe

pid process

1340 gghhkk.exe

pid	process
2620	gghhkk.exe
1340	gghhkk.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	gghhkk.exe

flow	ioc
14	api.ipify.org

pid	process
1340	gghhkk.exe
1340	gghhkk.exe
1340	gghhkk.exe
1340	gghhkk.exe

description	pid	process
Token: SeDebugPrivilege	1340	gghhkk.exe

pid	process
1340	gghhkk.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

WScript.exegghhkk.exegghhkk.exe

description	pid	process	target process
PID 640 wrote to memory of 2620	640	WScript.exe	gghhkk.exe
PID 640 wrote to memory of 2620	640	WScript.exe	gghhkk.exe
PID 640 wrote to memory of 2620	640	WScript.exe	gghhkk.exe
PID 2620 wrote to memory of 2944	2620	gghhkk.exe	cmd.exe
PID 2620 wrote to memory of 2944	2620	gghhkk.exe	cmd.exe
PID 2620 wrote to memory of 2944	2620	gghhkk.exe	cmd.exe
PID 2620 wrote to memory of 2204	2620	gghhkk.exe	cmd.exe
PID 2620 wrote to memory of 2204	2620	gghhkk.exe	cmd.exe
PID 2620 wrote to memory of 2204	2620	gghhkk.exe	cmd.exe
PID 2620 wrote to memory of 1340	2620	gghhkk.exe	gghhkk.exe
PID 2620 wrote to memory of 1340	2620	gghhkk.exe	gghhkk.exe
PID 2620 wrote to memory of 1340	2620	gghhkk.exe	gghhkk.exe
PID 1340 wrote to memory of 1524	1340	gghhkk.exe	cmd.exe
PID 1340 wrote to memory of 1524	1340	gghhkk.exe	cmd.exe
PID 1340 wrote to memory of 1524	1340	gghhkk.exe	cmd.exe
PID 1340 wrote to memory of 2856	1340	gghhkk.exe	cmd.exe
PID 1340 wrote to memory of 2856	1340	gghhkk.exe	cmd.exe
PID 1340 wrote to memory of 2856	1340	gghhkk.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sample (copy).vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Users\Admin\AppData\Local\Temp\gghhkk.exe
"C:\Users\Admin\AppData\Local\Temp\gghhkk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2204

C:\Users\Admin\AppData\Local\Temp\gghhkk.exe
"C:\Users\Admin\AppData\Local\Temp\gghhkk.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
4⤵
PID:2856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gghhkk.exe
MD5
d6351381a4847bf7b801a483efa9d619

SHA1
cd5a7a54d54a7f6649f997bf7c812f0aaa9f4253

SHA256
eca0f238bd7164fb9756e5e086598494cd6515a8e0f5d03b6e66771647de522e

SHA512
af9029477105733ca67299ae692dd6c2c3fde2ec17da62ccd7a9351526308704c6b75fd81a0229c25cd61e04d52e5fbd604fed3a4dbb1d6ceb875e31bf620f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\gghhkk.exe
MD5
d6351381a4847bf7b801a483efa9d619

SHA1
cd5a7a54d54a7f6649f997bf7c812f0aaa9f4253

SHA256
eca0f238bd7164fb9756e5e086598494cd6515a8e0f5d03b6e66771647de522e

SHA512
af9029477105733ca67299ae692dd6c2c3fde2ec17da62ccd7a9351526308704c6b75fd81a0229c25cd61e04d52e5fbd604fed3a4dbb1d6ceb875e31bf620f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\gghhkk.exe
MD5
d6351381a4847bf7b801a483efa9d619

SHA1
cd5a7a54d54a7f6649f997bf7c812f0aaa9f4253

SHA256
eca0f238bd7164fb9756e5e086598494cd6515a8e0f5d03b6e66771647de522e

SHA512
af9029477105733ca67299ae692dd6c2c3fde2ec17da62ccd7a9351526308704c6b75fd81a0229c25cd61e04d52e5fbd604fed3a4dbb1d6ceb875e31bf620f43

Download Submit
memory/1340-19-0x00000000200D0000-0x00000000200D1000-memory.dmp

Filesize
4KB

Download
memory/1340-18-0x0000000020240000-0x0000000020241000-memory.dmp

Filesize
4KB

Download
memory/1340-7-0x0000000000000000-mapping.dmp

Download
memory/1340-16-0x000000001FA50000-0x000000001FA51000-memory.dmp

Filesize
4KB

Download
memory/1340-17-0x0000000020070000-0x0000000020071000-memory.dmp

Filesize
4KB

Download
memory/1340-11-0x0000000072FA0000-0x000000007368E000-memory.dmp

Filesize
6.9MB

Download
memory/1340-12-0x000000001E7C0000-0x000000001E841000-memory.dmp

Filesize
516KB

Download
memory/1340-14-0x000000001ECB0000-0x000000001ECB1000-memory.dmp

Filesize
4KB

Download
memory/1340-15-0x000000001F250000-0x000000001F251000-memory.dmp

Filesize
4KB

Download
memory/1524-9-0x0000000000000000-mapping.dmp

Download
memory/2204-6-0x0000000000000000-mapping.dmp

Download
memory/2620-2-0x0000000000000000-mapping.dmp

Download
memory/2856-10-0x0000000000000000-mapping.dmp

Download
memory/2944-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing