Analysis

  • max time kernel
    4294180s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    26-03-2022 15:59

General

  • Target

    0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe

  • Size

    1.2MB

  • MD5

    a46f6ffa0918ef082d2ae1d61bbc19bc

  • SHA1

    95899af613e627c29fc919054314c75993a47e22

  • SHA256

    0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a

  • SHA512

    514508624dcf99b4128a760590d722d9cea31a38a414a282321a192950c1fe0e29bb020949da36456cc9acecd30229c650d5791cc68c182a920c781d98ca98fb

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
    "C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
      "C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:744
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 620
        3⤵
        • Program crash
        PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/744-61-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/744-57-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/744-58-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/744-60-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/744-62-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/744-65-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/744-67-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

  • memory/744-68-0x0000000076AC1000-0x0000000076AC3000-memory.dmp

    Filesize

    8KB

  • memory/912-55-0x0000000004DD0000-0x0000000004E68000-memory.dmp

    Filesize

    608KB

  • memory/912-56-0x00000000004E0000-0x00000000004FC000-memory.dmp

    Filesize

    112KB

  • memory/912-54-0x0000000001270000-0x00000000013A6000-memory.dmp

    Filesize

    1.2MB