masslogger | 5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567

Analysis

max time kernel
96s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01/05/2022, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
Size 725KB
Sample220501-3dkjmsahep
SHA256 5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567
MD5 f8adfc9f81ce2af0951b7c98d90d266a
SHA1 7d956f1ea408792d072b59cc4c3509445807cd9a
SHA512 e202eb75a89384d66738567ff049a11bb7aaccc9262c70771837f15d77f98c99b6f283a1aa23301f78eea9fce52d3749d740760bc14aad25e58fc6f4f6d993dd
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4212-133-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
4212	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
4212	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
4528	powershell.exe
4528	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
Token: SeDebugPrivilege	4212	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
Token: SeDebugPrivilege	4528	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87
PID 4872 wrote to memory of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87
PID 4872 wrote to memory of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87
PID 4872 wrote to memory of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87
PID 4872 wrote to memory of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87
PID 4872 wrote to memory of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87
PID 4872 wrote to memory of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87
PID 4872 wrote to memory of 4212	4872	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	87
PID 4212 wrote to memory of 4528	4212	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	99
PID 4212 wrote to memory of 4528	4212	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	99
PID 4212 wrote to memory of 4528	4212	5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe	99

C:\Users\Admin\AppData\Local\Temp\5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
"C:\Users\Admin\AppData\Local\Temp\5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5670b4d812cd81ee0fcfb393c62bb992e1b0a5feaa471910c4416ef28877c567.exe.log
Size 323B
SHA256 ac74e39389d05bc95d40efc9cc7f4726281809d360ab117f92685d3779a85af9
MD5 288c2dfaef4744587ed9babe65464432
SHA1 28da9bc6b0411d2eb02f5e68187ccc5b5d040cae
SHA512 48530d4bff93f816ddaa5aab1127d4ae6868a86bcf47eed6c1558e0ae9b6cb70a23fa6aca0dfd24b701cd2ab5075c8c0e100d40c94b08ea32123ec2866388b27
MD5 SHA1 SHA512

Submit Download

memory/4212-134-0x00000000052B0000-0x0000000005342000-memory.dmp

Download

memory/4212-136-0x0000000005350000-0x00000000053B6000-memory.dmp

Download

memory/4212-133-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4212-135-0x0000000005900000-0x0000000005EA4000-memory.dmp

Download

memory/4528-140-0x0000000005010000-0x0000000005638000-memory.dmp

Download

memory/4528-141-0x0000000004DE0000-0x0000000004E02000-memory.dmp

Download

memory/4528-139-0x0000000002470000-0x00000000024A6000-memory.dmp

Download

memory/4528-142-0x0000000004E80000-0x0000000004EE6000-memory.dmp

Download

memory/4528-143-0x0000000005D70000-0x0000000005D8E000-memory.dmp

Download

memory/4528-144-0x0000000007460000-0x0000000007ADA000-memory.dmp

Download

memory/4528-145-0x0000000006300000-0x000000000631A000-memory.dmp

Download

memory/4528-146-0x0000000006E80000-0x0000000006F16000-memory.dmp

Download

memory/4528-147-0x00000000063F0000-0x0000000006412000-memory.dmp

Download

memory/4872-131-0x000000000A9F0000-0x000000000AA8C000-memory.dmp

Download

memory/4872-130-0x0000000000820000-0x00000000008DE000-memory.dmp

Download