masslogger | 9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60

General

Target

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Size

1.1MB
MD5

ab41c3e043242673290648de262f675e
SHA1

79b01822385f4333f0fd8fe800b4b6dcf703de8c
SHA256

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60
SHA512

37bb4ab731730e106e1a44d9c1db962f02eecf4f642a91888632a4b26d3ec56a88a3fddb68f234887da433dd9d844fc9271a16eed23efe6d1afde143072212e9

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3372-134-0x0000000000B90000-0x0000000000C16000-memory.dmp	family_masslogger
behavioral2/memory/3372-135-0x0000000000B90000-0x0000000000C16000-memory.dmp	family_masslogger

Drops startup file 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sososo.vbs notepad.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sososo.vbs	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	pid	process	target process
PID 2664 set thread context of 3372	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exepowershell.exe

pid	process
2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
3372	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
3372	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
3088	powershell.exe
3088	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

pid process

2664 9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3372	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
Token: SeDebugPrivilege	3088	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe

description	pid	process	target process
PID 2664 wrote to memory of 3112	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 2664 wrote to memory of 3112	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 2664 wrote to memory of 3112	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 2664 wrote to memory of 3112	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 2664 wrote to memory of 3112	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	notepad.exe
PID 2664 wrote to memory of 3372	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
PID 2664 wrote to memory of 3372	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
PID 2664 wrote to memory of 3372	2664	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
PID 3372 wrote to memory of 3088	3372	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 3372 wrote to memory of 3088	3372	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe
PID 3372 wrote to memory of 3088	3372	9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
"C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:3112
- C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe
  "C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\9d74aba8294f64958d98e83c56e7859650d3a1becdafd7967c6f6dd0cf1ebf60.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-131-0x00000000044F0000-0x0000000004502000-memory.dmp

Filesize
72KB

Download
memory/3088-155-0x0000000004845000-0x0000000004847000-memory.dmp

Filesize
8KB

Download
memory/3088-159-0x0000000005FD0000-0x0000000005FF2000-memory.dmp

Filesize
136KB

Download
memory/3088-158-0x0000000006C50000-0x0000000006CE6000-memory.dmp

Filesize
600KB

Download
memory/3088-157-0x0000000005EC0000-0x0000000005EDA000-memory.dmp

Filesize
104KB

Download
memory/3088-156-0x0000000007230000-0x00000000078AA000-memory.dmp

Filesize
6.5MB

Download
memory/3088-149-0x0000000000000000-mapping.dmp

Download
memory/3088-154-0x00000000059D0000-0x00000000059EE000-memory.dmp

Filesize
120KB

Download
memory/3088-153-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/3088-152-0x00000000054F0000-0x0000000005512000-memory.dmp

Filesize
136KB

Download
memory/3088-151-0x0000000004E80000-0x00000000054A8000-memory.dmp

Filesize
6.2MB

Download
memory/3088-150-0x0000000000C40000-0x0000000000C76000-memory.dmp

Filesize
216KB

Download
memory/3112-132-0x0000000000000000-mapping.dmp

Download
memory/3372-136-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-142-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-146-0x0000000004BF0000-0x0000000004C82000-memory.dmp

Filesize
584KB

Download
memory/3372-147-0x0000000004E50000-0x00000000053F4000-memory.dmp

Filesize
5.6MB

Download
memory/3372-148-0x0000000005400000-0x0000000005466000-memory.dmp

Filesize
408KB

Download
memory/3372-144-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-143-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-145-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-141-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-140-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-139-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-138-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-137-0x0000000000C42000-0x0000000000C43000-memory.dmp

Filesize
4KB

Download
memory/3372-135-0x0000000000B90000-0x0000000000C16000-memory.dmp

Filesize
536KB

Download
memory/3372-134-0x0000000000B90000-0x0000000000C16000-memory.dmp

Filesize
536KB

Download
memory/3372-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads