masslogger | cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87

Analysis

max time kernel
89s
max time network
94s
platform
windows7_x64
resource
win7-20220331-en
submitted
29/03/2022, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe
Size 1.4MB
Sample220329-2brdqscbb2
SHA256 cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87
MD5 4a5d1e29a280df8c5fbf7c7e8cb0223d
SHA1 5efe0281b9494861273fecd6053e0fb499683ce3
SHA512 9b98605b40e442082eb2dfba12939b65c08bc28dc7927f4c6cfec01dcea9ca87cdc2261b8e6ff2f7e8dae2d204f155b4bdfb1c8110d0b663bd905291e1b7624f
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1256-63-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/1256-62-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/1256-65-0x0000000000481B0E-mapping.dmp	family_masslogger
behavioral1/memory/1256-64-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/1256-67-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/1256-69-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Executes dropped EXE 1 IoCs

pid	Process
1948	Firefox.exe

Loads dropped DLL 1 IoCs

pid	Process
1564	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1280	schtasks.exe
1780	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
936	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe
1256	RegSvcs.exe
1256	RegSvcs.exe
1256	RegSvcs.exe
1256	RegSvcs.exe
1244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe
Token: SeDebugPrivilege	1256	RegSvcs.exe
Token: SeDebugPrivilege	1244	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1280	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	28
PID 2012 wrote to memory of 1280	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	28
PID 2012 wrote to memory of 1280	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	28
PID 2012 wrote to memory of 1280	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	28
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 2012 wrote to memory of 1256	2012	cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe	30
PID 1256 wrote to memory of 1244	1256	RegSvcs.exe	32
PID 1256 wrote to memory of 1244	1256	RegSvcs.exe	32
PID 1256 wrote to memory of 1244	1256	RegSvcs.exe	32
PID 1256 wrote to memory of 1244	1256	RegSvcs.exe	32
PID 1256 wrote to memory of 1712	1256	RegSvcs.exe	34
PID 1256 wrote to memory of 1712	1256	RegSvcs.exe	34
PID 1256 wrote to memory of 1712	1256	RegSvcs.exe	34
PID 1256 wrote to memory of 1712	1256	RegSvcs.exe	34
PID 1712 wrote to memory of 1780	1712	cmd.exe	36
PID 1712 wrote to memory of 1780	1712	cmd.exe	36
PID 1712 wrote to memory of 1780	1712	cmd.exe	36
PID 1712 wrote to memory of 1780	1712	cmd.exe	36
PID 1256 wrote to memory of 1564	1256	RegSvcs.exe	38
PID 1256 wrote to memory of 1564	1256	RegSvcs.exe	38
PID 1256 wrote to memory of 1564	1256	RegSvcs.exe	38
PID 1256 wrote to memory of 1564	1256	RegSvcs.exe	38
PID 1564 wrote to memory of 936	1564	cmd.exe	39
PID 1564 wrote to memory of 936	1564	cmd.exe	39
PID 1564 wrote to memory of 936	1564	cmd.exe	39
PID 1564 wrote to memory of 936	1564	cmd.exe	39
PID 1564 wrote to memory of 1948	1564	cmd.exe	40
PID 1564 wrote to memory of 1948	1564	cmd.exe	40
PID 1564 wrote to memory of 1948	1564	cmd.exe	40
PID 1564 wrote to memory of 1948	1564	cmd.exe	40
PID 1564 wrote to memory of 1948	1564	cmd.exe	40
PID 1564 wrote to memory of 1948	1564	cmd.exe	40
PID 1564 wrote to memory of 1948	1564	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe
"C:\Users\Admin\AppData\Local\Temp\cdcca14762350631687767fbf582ddbb3c9a84fbae2235d308b8e1fa2077af87.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eqOznKoNHJb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF97C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn Firefox.exe /tr '"C:\Users\Admin\AppData\Roaming\Firefox\Firefox.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn Firefox.exe /tr '"C:\Users\Admin\AppData\Roaming\Firefox\Firefox.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp77FE.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:936
  - - C:\Users\Admin\AppData\Roaming\Firefox\Firefox.exe
      "C:\Users\Admin\AppData\Roaming\Firefox\Firefox.exe"
      4⤵
      Executes dropped EXE
      PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp77FE.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp77FE.tmp.bat
Size 159B
SHA256 ede91006064ebcfe27db7f24b681b166d366e7f6da694d7ac5b90e35e205e794
MD5 9d094b4097c03d1df4be21ba7798c097
SHA1 724162388bee4192ac21db773cea02468a570878
SHA512 1f6a94158d5822f697b5e878784eb72352d272f872bfeba962ecc45a52510055fabc74facf48ee469fea702d424c0202f1e50748ec767da28cb7a658827f6f9d
MD5 SHA1 SHA512

Submit Download

tmpF97C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF97C.tmp
Size 1KB
SHA256 90d475e9742a189a21a24a519eecc5bdd03b25b000db57f5c2ff46c1f510e9eb
MD5 22a78f22b48fa1bd9279c41f6156171d
SHA1 70650102dcdbaa8785e34f106e87589214d568f3
SHA512 87e094b238093e59408fa5e0bb9978bf424d6dd13f535fa781f5dfbfe16f5e829a9536339838d80d43f549fec1eddf8a34c31a1df650fc3a4bb88e2e65b32033
MD5 SHA1 SHA512

Submit Download

Firefox.exe

Path C:\Users\Admin\AppData\Roaming\Firefox\Firefox.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Firefox.exe

Path C:\Users\Admin\AppData\Roaming\Firefox\Firefox.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Firefox.exe

Path \Users\Admin\AppData\Roaming\Firefox\Firefox.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1244-79-0x00000000024B2000-0x00000000024B4000-memory.dmp

Download

memory/1244-78-0x0000000074D20000-0x00000000752CB000-memory.dmp

Download

memory/1244-72-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Download

memory/1256-63-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1256-62-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1256-69-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1256-64-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1256-71-0x0000000002035000-0x0000000002046000-memory.dmp

Download

memory/1256-59-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1256-60-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1256-67-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1948-84-0x00000000000A0000-0x00000000000AE000-memory.dmp

Download

memory/1948-85-0x0000000000550000-0x0000000000570000-memory.dmp

Download

memory/2012-54-0x0000000000FA0000-0x0000000001104000-memory.dmp

Download

memory/2012-56-0x0000000007F60000-0x0000000008012000-memory.dmp

Download

memory/2012-55-0x0000000000550000-0x000000000056C000-memory.dmp

Download