masslogger | 0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a

Analysis

max time kernel
130s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
26/03/2022, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
Size 1.2MB
Sample220326-tfcgdaefa7
SHA256 0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a
MD5 a46f6ffa0918ef082d2ae1d61bbc19bc
SHA1 95899af613e627c29fc919054314c75993a47e22
SHA512 514508624dcf99b4128a760590d722d9cea31a38a414a282321a192950c1fe0e29bb020949da36456cc9acecd30229c650d5791cc68c182a920c781d98ca98fb
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4396-135-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4192	4396	WerFault.exe	86

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86
PID 2732 wrote to memory of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86
PID 2732 wrote to memory of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86
PID 2732 wrote to memory of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86
PID 2732 wrote to memory of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86
PID 2732 wrote to memory of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86
PID 2732 wrote to memory of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86
PID 2732 wrote to memory of 4396	2732	0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe	86

C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
"C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
  "C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe"
  2⤵
  PID:4396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 968
    3⤵
    - Program crash
    PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4396 -ip 4396
1⤵
PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-130-0x0000000000290000-0x00000000003C6000-memory.dmp

Download

memory/2732-131-0x00000000053C0000-0x0000000005964000-memory.dmp

Download

memory/2732-132-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Download

memory/2732-133-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Download

memory/4396-135-0x0000000000400000-0x000000000048C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads