Analysis

  • max time kernel
    130s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26-03-2022 15:59

General

  • Target

    0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe

  • Size

    1.2MB

  • MD5

    a46f6ffa0918ef082d2ae1d61bbc19bc

  • SHA1

    95899af613e627c29fc919054314c75993a47e22

  • SHA256

    0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a

  • SHA512

    514508624dcf99b4128a760590d722d9cea31a38a414a282321a192950c1fe0e29bb020949da36456cc9acecd30229c650d5791cc68c182a920c781d98ca98fb

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
    "C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe
      "C:\Users\Admin\AppData\Local\Temp\0d50bd0cc53c8e23b721ea822fc55a98f2f64e9391d006071f847345878f249a.exe"
      2⤵
        PID:4396
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 968
          3⤵
          • Program crash
          PID:4192
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4396 -ip 4396
      1⤵
        PID:3896

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2732-130-0x0000000000290000-0x00000000003C6000-memory.dmp

        Filesize

        1.2MB

      • memory/2732-131-0x00000000053C0000-0x0000000005964000-memory.dmp

        Filesize

        5.6MB

      • memory/2732-132-0x0000000004D60000-0x0000000004DF2000-memory.dmp

        Filesize

        584KB

      • memory/2732-133-0x0000000004F30000-0x0000000004F3A000-memory.dmp

        Filesize

        40KB

      • memory/4396-135-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB