masslogger | a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63

General

Target

a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe
Size

1.0MB
MD5

c0ed9bbcff47e00344d20760e249ae66
SHA1

d38438bc727646bccd72bed89428b69753b2178a
SHA256

a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63
SHA512

8c7b5def759dfeeb2e4d962a419a2f33adfcdb0668be37696eda9fe5ae81752a43b41b3415fb4a5c2be496f7c471a70be0725dd6f50725e86c9e666fec70eef7

Score

10^/10

masslogger persistence spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 6 IoCs

resource	yara_rule
behavioral1/memory/2044-71-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/2044-72-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/2044-74-0x00000000004819EE-mapping.dmp	family_masslogger
behavioral1/memory/2044-77-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/2044-73-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral1/memory/2044-79-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Executes dropped EXE 2 IoCs

pid	Process
1976	batt.exe
2044	batt.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation	batt.exe

Loads dropped DLL 2 IoCs

pid	Process
908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe
1976	batt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\batt = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Music\\batt.exe"	reg.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 2044	1976	batt.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe
908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe
1976	batt.exe
2044	batt.exe
2044	batt.exe
2044	batt.exe
2044	batt.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe
Token: SeTakeOwnershipPrivilege	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe
Token: SeRestorePrivilege	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe
Token: SeDebugPrivilege	1976	batt.exe
Token: SeTakeOwnershipPrivilege	1976	batt.exe
Token: SeRestorePrivilege	1976	batt.exe
Token: SeDebugPrivilege	2044	batt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2044	batt.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1936	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe	27
PID 908 wrote to memory of 1936	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe	27
PID 908 wrote to memory of 1936	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe	27
PID 908 wrote to memory of 1936	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe	27
PID 1936 wrote to memory of 1136	1936	cmd.exe	29
PID 1936 wrote to memory of 1136	1936	cmd.exe	29
PID 1936 wrote to memory of 1136	1936	cmd.exe	29
PID 1936 wrote to memory of 1136	1936	cmd.exe	29
PID 908 wrote to memory of 1976	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe	30
PID 908 wrote to memory of 1976	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe	30
PID 908 wrote to memory of 1976	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe	30
PID 908 wrote to memory of 1976	908	a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe	30
PID 1976 wrote to memory of 2044	1976	batt.exe	31
PID 1976 wrote to memory of 2044	1976	batt.exe	31
PID 1976 wrote to memory of 2044	1976	batt.exe	31
PID 1976 wrote to memory of 2044	1976	batt.exe	31
PID 1976 wrote to memory of 2044	1976	batt.exe	31
PID 1976 wrote to memory of 2044	1976	batt.exe	31
PID 1976 wrote to memory of 2044	1976	batt.exe	31
PID 1976 wrote to memory of 2044	1976	batt.exe	31
PID 1976 wrote to memory of 2044	1976	batt.exe	31

C:\Users\Admin\AppData\Local\Temp\a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe
"C:\Users\Admin\AppData\Local\Temp\a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v batt /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Music\batt.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v batt /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Music\batt.exe"
    3⤵
    - Adds Run key to start application
    PID:1136
- C:\Users\Admin\Music\batt.exe
  "C:\Users\Admin\Music\batt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Users\Admin\Music\batt.exe
    "C:\Users\Admin\Music\batt.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Music\batt.exe

Filesize
1.0MB

MD5
c0ed9bbcff47e00344d20760e249ae66

SHA1
d38438bc727646bccd72bed89428b69753b2178a

SHA256
a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63

SHA512
8c7b5def759dfeeb2e4d962a419a2f33adfcdb0668be37696eda9fe5ae81752a43b41b3415fb4a5c2be496f7c471a70be0725dd6f50725e86c9e666fec70eef7

Download Submit
C:\Users\Admin\Music\batt.exe

Filesize
1.0MB

MD5
c0ed9bbcff47e00344d20760e249ae66

SHA1
d38438bc727646bccd72bed89428b69753b2178a

SHA256
a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63

SHA512
8c7b5def759dfeeb2e4d962a419a2f33adfcdb0668be37696eda9fe5ae81752a43b41b3415fb4a5c2be496f7c471a70be0725dd6f50725e86c9e666fec70eef7

Download Submit
C:\Users\Admin\Music\batt.exe

Filesize
1.0MB

MD5
c0ed9bbcff47e00344d20760e249ae66

SHA1
d38438bc727646bccd72bed89428b69753b2178a

SHA256
a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63

SHA512
8c7b5def759dfeeb2e4d962a419a2f33adfcdb0668be37696eda9fe5ae81752a43b41b3415fb4a5c2be496f7c471a70be0725dd6f50725e86c9e666fec70eef7

Download Submit
\Users\Admin\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
\Users\Admin\Music\batt.exe

Filesize
1.0MB

MD5
c0ed9bbcff47e00344d20760e249ae66

SHA1
d38438bc727646bccd72bed89428b69753b2178a

SHA256
a23452b73a4411048351ea4b33106feb883a70940ad0cc9ed46e2c32f8350d63

SHA512
8c7b5def759dfeeb2e4d962a419a2f33adfcdb0668be37696eda9fe5ae81752a43b41b3415fb4a5c2be496f7c471a70be0725dd6f50725e86c9e666fec70eef7

Download Submit
memory/908-54-0x0000000000E50000-0x0000000000F56000-memory.dmp

Filesize
1.0MB

Download
memory/908-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/908-56-0x00000000002F0000-0x000000000031A000-memory.dmp

Filesize
168KB

Download
memory/1976-65-0x00000000004F0000-0x000000000050C000-memory.dmp

Filesize
112KB

Download
memory/1976-63-0x0000000000BA0000-0x0000000000CA6000-memory.dmp

Filesize
1.0MB

Download
memory/1976-67-0x0000000074780000-0x0000000074800000-memory.dmp

Filesize
512KB

Download
memory/2044-68-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2044-69-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2044-71-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2044-72-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2044-77-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2044-73-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2044-79-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2044-81-0x0000000004C95000-0x0000000004CA6000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing