masslogger | cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c

General

Target

cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
Size

1.3MB
MD5

3a95df0caf42223a908cff89bd9c9d29
SHA1

874f02d9f171f5151259de04cd2aea8880d6f23a
SHA256

cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c
SHA512

5eebba17d01dcf050f8a19d7b5d1ca269cc3492f754eca94e872e751c7eef4d0c4d09eaa3366119be90d182aef604b495e067df5990876ddf57e6efb3626e772

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1552-61-0x0000000000090000-0x000000000011C000-memory.dmp	family_masslogger
behavioral1/memory/1552-62-0x0000000000090000-0x000000000011C000-memory.dmp	family_masslogger
behavioral1/memory/1552-64-0x000000000048735E-mapping.dmp	family_masslogger
behavioral1/memory/1552-66-0x0000000000090000-0x000000000011C000-memory.dmp	family_masslogger
behavioral1/memory/1552-65-0x0000000000090000-0x000000000011C000-memory.dmp	family_masslogger
behavioral1/memory/1552-70-0x0000000000090000-0x000000000011C000-memory.dmp	family_masslogger
behavioral1/memory/1552-73-0x0000000000090000-0x000000000011C000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe

description	pid	process	target process
PID 1280 set thread context of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1752 1552 WerFault.exe InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe

description pid process

Token: SeDebugPrivilege 1280 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe

pid	pid_target	process	target process
1752	1552	WerFault.exe	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exeInstallUtil.exe

description	pid	process	target process
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1280 wrote to memory of 1552	1280	cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe	InstallUtil.exe
PID 1552 wrote to memory of 1752	1552	InstallUtil.exe	WerFault.exe
PID 1552 wrote to memory of 1752	1552	InstallUtil.exe	WerFault.exe
PID 1552 wrote to memory of 1752	1552	InstallUtil.exe	WerFault.exe
PID 1552 wrote to memory of 1752	1552	InstallUtil.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
"C:\Users\Admin\AppData\Local\Temp\cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 612
    3⤵
    - Program crash
    PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-54-0x0000000000F70000-0x00000000010C2000-memory.dmp

Filesize
1.3MB

Download
memory/1280-55-0x00000000004B0000-0x00000000004D0000-memory.dmp

Filesize
128KB

Download
memory/1280-56-0x00000000004E0000-0x0000000000504000-memory.dmp

Filesize
144KB

Download
memory/1280-57-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1552-58-0x0000000000090000-0x000000000011C000-memory.dmp

Filesize
560KB

Download
memory/1552-59-0x0000000000090000-0x000000000011C000-memory.dmp

Filesize
560KB

Download
memory/1552-61-0x0000000000090000-0x000000000011C000-memory.dmp

Filesize
560KB

Download
memory/1552-62-0x0000000000090000-0x000000000011C000-memory.dmp

Filesize
560KB

Download
memory/1552-64-0x000000000048735E-mapping.dmp

Download
memory/1552-66-0x0000000000090000-0x000000000011C000-memory.dmp

Filesize
560KB

Download
memory/1552-65-0x0000000000090000-0x000000000011C000-memory.dmp

Filesize
560KB

Download
memory/1552-70-0x0000000000090000-0x000000000011C000-memory.dmp

Filesize
560KB

Download
memory/1552-73-0x0000000000090000-0x000000000011C000-memory.dmp

Filesize
560KB

Download
memory/1552-74-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1752-75-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads