Analysis
-
max time kernel
4294178s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
26-03-2022 18:16
Static task
static1
Behavioral task
behavioral1
Sample
cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
Resource
win10v2004-en-20220113
General
-
Target
cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
-
Size
1.3MB
-
MD5
3a95df0caf42223a908cff89bd9c9d29
-
SHA1
874f02d9f171f5151259de04cd2aea8880d6f23a
-
SHA256
cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c
-
SHA512
5eebba17d01dcf050f8a19d7b5d1ca269cc3492f754eca94e872e751c7eef4d0c4d09eaa3366119be90d182aef604b495e067df5990876ddf57e6efb3626e772
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 7 IoCs
resource yara_rule behavioral1/memory/1552-61-0x0000000000090000-0x000000000011C000-memory.dmp family_masslogger behavioral1/memory/1552-62-0x0000000000090000-0x000000000011C000-memory.dmp family_masslogger behavioral1/memory/1552-64-0x000000000048735E-mapping.dmp family_masslogger behavioral1/memory/1552-66-0x0000000000090000-0x000000000011C000-memory.dmp family_masslogger behavioral1/memory/1552-65-0x0000000000090000-0x000000000011C000-memory.dmp family_masslogger behavioral1/memory/1552-70-0x0000000000090000-0x000000000011C000-memory.dmp family_masslogger behavioral1/memory/1552-73-0x0000000000090000-0x000000000011C000-memory.dmp family_masslogger -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1280 set thread context of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 -
Program crash 1 IoCs
pid pid_target Process procid_target 1752 1552 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1280 wrote to memory of 1552 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 27 PID 1552 wrote to memory of 1752 1552 InstallUtil.exe 28 PID 1552 wrote to memory of 1752 1552 InstallUtil.exe 28 PID 1552 wrote to memory of 1752 1552 InstallUtil.exe 28 PID 1552 wrote to memory of 1752 1552 InstallUtil.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe"C:\Users\Admin\AppData\Local\Temp\cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 6123⤵
- Program crash
PID:1752
-
-