masslogger | a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c

Analysis

max time kernel
129s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01/05/2022, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
Size 1007KB
Sample220501-3e4c5sech5
SHA256 a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c
MD5 38cf72bca28919c932497b80d07c2af5
SHA1 11a6cbfa3fc19bb488fcf395cfa448e63860596c
SHA512 ebdb817b8ebb3cd131387c97808e6ae60055d02aa1c7b15beb14a6e693b103e74c2da52ffba39b73af26851421de21274d3c13dd46fac4a50b130ca48b9a8bf8
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3800-136-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4692 set thread context of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
3800	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
3800	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
1416	powershell.exe
1416	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
Token: SeDebugPrivilege	3800	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
Token: SeDebugPrivilege	1416	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98
PID 4692 wrote to memory of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98
PID 4692 wrote to memory of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98
PID 4692 wrote to memory of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98
PID 4692 wrote to memory of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98
PID 4692 wrote to memory of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98
PID 4692 wrote to memory of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98
PID 4692 wrote to memory of 3800	4692	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	98
PID 3800 wrote to memory of 1416	3800	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	99
PID 3800 wrote to memory of 1416	3800	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	99
PID 3800 wrote to memory of 1416	3800	a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe	99

C:\Users\Admin\AppData\Local\Temp\a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
"C:\Users\Admin\AppData\Local\Temp\a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a3310b5080f0d20d4312edc54246ed4376edee9e1457a6c1e77975a47446110c.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

memory/1416-142-0x0000000005660000-0x0000000005682000-memory.dmp

Download

memory/1416-144-0x0000000006620000-0x000000000663E000-memory.dmp

Download

memory/1416-148-0x0000000006BF0000-0x0000000006C12000-memory.dmp

Download

memory/1416-147-0x00000000078A0000-0x0000000007936000-memory.dmp

Download

memory/1416-146-0x0000000006B30000-0x0000000006B4A000-memory.dmp

Download

memory/1416-145-0x0000000007F20000-0x000000000859A000-memory.dmp

Download

memory/1416-143-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Download

memory/1416-140-0x0000000002CF0000-0x0000000002D26000-memory.dmp

Download

memory/1416-141-0x0000000005790000-0x0000000005DB8000-memory.dmp

Download

memory/3800-137-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Download

memory/3800-136-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4692-132-0x0000000004C90000-0x0000000004D22000-memory.dmp

Download

memory/4692-130-0x0000000000190000-0x0000000000292000-memory.dmp

Download

memory/4692-131-0x00000000051A0000-0x0000000005744000-memory.dmp

Download

memory/4692-134-0x000000000CBC0000-0x000000000CC5C000-memory.dmp

Download

memory/4692-133-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Download