masslogger | e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7

General

Target

e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
Size

734KB
MD5

dfe91810fa28948dc0ff20dcc0230720
SHA1

85c8a80b99e4394d04878f47edacaa5f65b9bd3b
SHA256

e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7
SHA512

349a8ac9f54be2abf42ef1b89cf8946e7643cd4a7a42488ec0755c1cf10e86671ade6d43e8fee8d7fa89c0b4aceb3b2467b6bd73eef8bf7833e945a347cc1b6f

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2044-60-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/2044-61-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/2044-63-0x0000000000486FDE-mapping.dmp	family_masslogger
behavioral1/memory/2044-62-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/2044-65-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger
behavioral1/memory/2044-67-0x0000000000400000-0x000000000048C000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe

description	pid	process	target process
PID 1056 set thread context of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 2044 WerFault.exe e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe

pid	pid_target	process	target process
1916	2044	WerFault.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exee0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe

description	pid	process	target process
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 1056 wrote to memory of 2044	1056	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
PID 2044 wrote to memory of 1916	2044	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	WerFault.exe
PID 2044 wrote to memory of 1916	2044	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	WerFault.exe
PID 2044 wrote to memory of 1916	2044	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	WerFault.exe
PID 2044 wrote to memory of 1916	2044	e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
"C:\Users\Admin\AppData\Local\Temp\e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\e0fc4cd55ad749f411ecfd308911e98e8c2d94b518c159a93a08b686c23aa7b7.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 620
    3⤵
    - Program crash
    PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-54-0x00000000011F0000-0x00000000012AE000-memory.dmp

Filesize
760KB

Download
memory/1056-55-0x0000000000A10000-0x0000000000A2C000-memory.dmp

Filesize
112KB

Download
memory/1056-56-0x0000000008260000-0x0000000008316000-memory.dmp

Filesize
728KB

Download
memory/1916-69-0x0000000000000000-mapping.dmp

Download
memory/2044-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2044-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2044-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2044-63-0x0000000000486FDE-mapping.dmp

Download
memory/2044-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2044-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2044-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2044-68-0x0000000075B01000-0x0000000075B03000-memory.dmp

Filesize
8KB

Download
memory/2044-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads