Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26-03-2022 18:16

General

  • Target

    cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe

  • Size

    1.3MB

  • MD5

    3a95df0caf42223a908cff89bd9c9d29

  • SHA1

    874f02d9f171f5151259de04cd2aea8880d6f23a

  • SHA256

    cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c

  • SHA512

    5eebba17d01dcf050f8a19d7b5d1ca269cc3492f754eca94e872e751c7eef4d0c4d09eaa3366119be90d182aef604b495e067df5990876ddf57e6efb3626e772

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • MassLogger Main Payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
    "C:\Users\Admin\AppData\Local\Temp\cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:1704
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 944
          3⤵
          • Program crash
          PID:3016
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1704 -ip 1704
      1⤵
        PID:2772

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1704-136-0x0000000000400000-0x000000000048C000-memory.dmp

        Filesize

        560KB

      • memory/3628-130-0x0000000000D90000-0x0000000000EE2000-memory.dmp

        Filesize

        1.3MB

      • memory/3628-131-0x0000000005880000-0x000000000591C000-memory.dmp

        Filesize

        624KB

      • memory/3628-132-0x0000000008640000-0x0000000008BE4000-memory.dmp

        Filesize

        5.6MB

      • memory/3628-133-0x0000000008170000-0x0000000008202000-memory.dmp

        Filesize

        584KB

      • memory/3628-134-0x0000000003160000-0x0000000003182000-memory.dmp

        Filesize

        136KB