Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 18:16
Static task
static1
Behavioral task
behavioral1
Sample
cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
Resource
win10v2004-en-20220113
General
-
Target
cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe
-
Size
1.3MB
-
MD5
3a95df0caf42223a908cff89bd9c9d29
-
SHA1
874f02d9f171f5151259de04cd2aea8880d6f23a
-
SHA256
cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c
-
SHA512
5eebba17d01dcf050f8a19d7b5d1ca269cc3492f754eca94e872e751c7eef4d0c4d09eaa3366119be90d182aef604b495e067df5990876ddf57e6efb3626e772
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
resource yara_rule behavioral2/memory/1704-136-0x0000000000400000-0x000000000048C000-memory.dmp family_masslogger -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3628 set thread context of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83 -
Program crash 1 IoCs
pid pid_target Process procid_target 3016 1704 WerFault.exe 83 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3628 wrote to memory of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83 PID 3628 wrote to memory of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83 PID 3628 wrote to memory of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83 PID 3628 wrote to memory of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83 PID 3628 wrote to memory of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83 PID 3628 wrote to memory of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83 PID 3628 wrote to memory of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83 PID 3628 wrote to memory of 1704 3628 cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe"C:\Users\Admin\AppData\Local\Temp\cafe84622c1b30366fbd24f1121a87942e08ab7fbe8ab2ad8da4b2d08a1b781c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:1704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 9443⤵
- Program crash
PID:3016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1704 -ip 17041⤵PID:2772