masslogger | 0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a

General

Target
0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
Size 1.2MB
Sample220326-tfcgdaefa7
SHA256 0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a
MD5 a46f6ffa0918ef082d2ae1d61bbc19bc
SHA1 95899af613e627c29fc919054314c75993a47e22
SHA512 514508624dcf99b4128a760590d722d9cea31a38a414a282321a192950c1fe0e29bb020949da36456cc9acecd30229c650d5791cc68c182a920c781d98ca98fb
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 6 IoCs

resource	yara_rule
behavioral1/memory/744-60-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/744-61-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/744-62-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/744-63-0x000000000048741E-mapping.dmp	family_masslogger
behavioral1/memory/744-65-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/744-67-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	744	WerFault.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 912 wrote to memory of 744	912	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	29
PID 744 wrote to memory of 1968	744	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	30
PID 744 wrote to memory of 1968	744	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	30
PID 744 wrote to memory of 1968	744	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	30
PID 744 wrote to memory of 1968	744	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	30

C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
"C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
  "C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 620
    3⤵
    - Program crash
    PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-61-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/744-57-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/744-58-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/744-60-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/744-62-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/744-65-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/744-67-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/744-68-0x0000000076AC1000-0x0000000076AC3000-memory.dmp

Download

memory/912-55-0x0000000004DD0000-0x0000000004E68000-memory.dmp

Download

memory/912-56-0x00000000004E0000-0x00000000004FC000-memory.dmp

Download

memory/912-54-0x0000000001270000-0x00000000013A6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads