masslogger | 30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065

General

Target
30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe
Size 501KB
Sample220326-bhsx2abdgj
SHA256 30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065
MD5 788b1bd6f643d4639f59bedc87be2b56
SHA1 349fdc58c8bbac0cfc84330974a1eb89137cad70
SHA512 d9ab0ed5d7000db23c9f8628476b753ba9b01f859a5aaecc736b5f5e7b51b0dae182f16de1d5b1613ae5a56a9bc9bc85375b4ac7dffb8d2daef1d91a36a8f4c9
MD5 SHA1 SHA512

Score

10^/10

masslogger persistence spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2800-135-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\""	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 540 set thread context of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1852	2800	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79
PID 540 wrote to memory of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79
PID 540 wrote to memory of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79
PID 540 wrote to memory of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79
PID 540 wrote to memory of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79
PID 540 wrote to memory of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79
PID 540 wrote to memory of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79
PID 540 wrote to memory of 2800	540	30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe	79

C:\Users\Admin\AppData\Local\Temp\30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe
"C:\Users\Admin\AppData\Local\Temp\30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe
  "C:\Users\Admin\AppData\Local\Temp\30795aa80836c56b68e9325d1bd1f6462785a9d32ed84729ca205cb619b38065.exe"
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 980
    3⤵
    - Program crash
    PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2800 -ip 2800
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-130-0x0000000000820000-0x00000000008A2000-memory.dmp

Download

memory/540-131-0x00000000058B0000-0x0000000005E54000-memory.dmp

Download

memory/540-132-0x0000000005240000-0x00000000052D2000-memory.dmp

Download

memory/540-133-0x0000000005310000-0x000000000531A000-memory.dmp

Download

memory/2800-135-0x0000000000400000-0x000000000048C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads