masslogger | 4d098e12e21205c68dfe995b5e4ca60ab2fef5769f7eff8fcf63664fd154f534

Analysis

max time kernel
163s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02/05/2022, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xf10142020PurchaseOrder766657.exe
Size 2.1MB
Sample220502-swsmvsafar
SHA256 cfde16e103af9e59944d44d7f12e5755313948273cd64237df2dce50811866db
MD5 46f407da71637ad9654f4528fc06b504
SHA1 b682a05a1464e6a56a2334df1322bdb03cdbac1a
SHA512 10e01533192f6d6fa68e636c6215de3ff7174e856e31cbae48392587ddc5902a37004a8878913f959eb7cd9381f6bc398a558828815890e807017e616496a839
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2696-135-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Executes dropped EXE 1 IoCs

pid	Process
4308	apdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Xf10142020PurchaseOrder766657.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3268 set thread context of 2696	3268	Xf10142020PurchaseOrder766657.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3332	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5080	timeout.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3268	Xf10142020PurchaseOrder766657.exe
3268	Xf10142020PurchaseOrder766657.exe
3268	Xf10142020PurchaseOrder766657.exe
3268	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
2696	Xf10142020PurchaseOrder766657.exe
4376	powershell.exe
4376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	Xf10142020PurchaseOrder766657.exe
Token: SeDebugPrivilege	2696	Xf10142020PurchaseOrder766657.exe
Token: SeDebugPrivilege	4376	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 4944	3268	Xf10142020PurchaseOrder766657.exe	86
PID 3268 wrote to memory of 4944	3268	Xf10142020PurchaseOrder766657.exe	86
PID 3268 wrote to memory of 4944	3268	Xf10142020PurchaseOrder766657.exe	86
PID 3268 wrote to memory of 2084	3268	Xf10142020PurchaseOrder766657.exe	87
PID 3268 wrote to memory of 2084	3268	Xf10142020PurchaseOrder766657.exe	87
PID 3268 wrote to memory of 2084	3268	Xf10142020PurchaseOrder766657.exe	87
PID 3268 wrote to memory of 2696	3268	Xf10142020PurchaseOrder766657.exe	88
PID 3268 wrote to memory of 2696	3268	Xf10142020PurchaseOrder766657.exe	88
PID 3268 wrote to memory of 2696	3268	Xf10142020PurchaseOrder766657.exe	88
PID 3268 wrote to memory of 2696	3268	Xf10142020PurchaseOrder766657.exe	88
PID 3268 wrote to memory of 2696	3268	Xf10142020PurchaseOrder766657.exe	88
PID 3268 wrote to memory of 2696	3268	Xf10142020PurchaseOrder766657.exe	88
PID 3268 wrote to memory of 2696	3268	Xf10142020PurchaseOrder766657.exe	88
PID 3268 wrote to memory of 2696	3268	Xf10142020PurchaseOrder766657.exe	88
PID 2696 wrote to memory of 4376	2696	Xf10142020PurchaseOrder766657.exe	93
PID 2696 wrote to memory of 4376	2696	Xf10142020PurchaseOrder766657.exe	93
PID 2696 wrote to memory of 4376	2696	Xf10142020PurchaseOrder766657.exe	93
PID 2696 wrote to memory of 4864	2696	Xf10142020PurchaseOrder766657.exe	97
PID 2696 wrote to memory of 4864	2696	Xf10142020PurchaseOrder766657.exe	97
PID 2696 wrote to memory of 4864	2696	Xf10142020PurchaseOrder766657.exe	97
PID 2696 wrote to memory of 1348	2696	Xf10142020PurchaseOrder766657.exe	99
PID 2696 wrote to memory of 1348	2696	Xf10142020PurchaseOrder766657.exe	99
PID 2696 wrote to memory of 1348	2696	Xf10142020PurchaseOrder766657.exe	99
PID 4864 wrote to memory of 3332	4864	cmd.exe	101
PID 4864 wrote to memory of 3332	4864	cmd.exe	101
PID 4864 wrote to memory of 3332	4864	cmd.exe	101
PID 1348 wrote to memory of 5080	1348	cmd.exe	102
PID 1348 wrote to memory of 5080	1348	cmd.exe	102
PID 1348 wrote to memory of 5080	1348	cmd.exe	102
PID 1348 wrote to memory of 4308	1348	cmd.exe	103
PID 1348 wrote to memory of 4308	1348	cmd.exe	103
PID 1348 wrote to memory of 4308	1348	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe
"C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe
  "C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe"
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe
  "C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe"
  2⤵
  PID:2084
- C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe
  "C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Xf10142020PurchaseOrder766657.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn apdate.exe /tr '"C:\Users\Admin\AppData\Roaming\apdate\apdate.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn apdate.exe /tr '"C:\Users\Admin\AppData\Roaming\apdate\apdate.exe"'
      4⤵
      Creates scheduled task(s)
      PID:3332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD627.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5080
  - - C:\Users\Admin\AppData\Roaming\apdate\apdate.exe
      "C:\Users\Admin\AppData\Roaming\apdate\apdate.exe"
      4⤵
      Executes dropped EXE
      PID:4308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Xf10142020PurchaseOrder766657.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Xf10142020PurchaseOrder766657.exe.log
Size 318B
SHA256 06e03bc8ce534b3c6b6e1d26b9a0ab0acdf09f06d46969144186a69fcf8129aa
MD5 51157910b86291e93bd1968c56ca70fb
SHA1 b1ba3bdd6eb9aba9bf084b3d7987f7636e2aa4d9
SHA512 da5d08989ff38c56a512f7a4fb72102c06ffacd65ed6eb220551fdfb2e6899d77d83fabd1238d487c7901da7d406d0967975b0e1eab5d13f02c7d1e19559083f
MD5 SHA1 SHA512

Submit Download

tmpD627.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpD627.tmp.bat
Size 157B
SHA256 40594510d9b705d6263d68bae1094dc5dfd3677503bc4ac03e8ce01920d05f3f
MD5 2e8a1bfc1d73446197eb6eea3d5d33eb
SHA1 cde6c3ee4f76eaf107317ee635ef4c278d89ed3c
SHA512 4db993df06dbf355aa9147fef3d7771d6bebd9cf8ab52798a40145ddbef430a8d4c515a9225877ff0abf4529069b7199253340b3ff635ac6c97e1dc28d7678fc
MD5 SHA1 SHA512

Submit Download

apdate.exe

Path C:\Users\Admin\AppData\Roaming\apdate\apdate.exe
Size 2.1MB
SHA256 cfde16e103af9e59944d44d7f12e5755313948273cd64237df2dce50811866db
MD5 46f407da71637ad9654f4528fc06b504
SHA1 b682a05a1464e6a56a2334df1322bdb03cdbac1a
SHA512 10e01533192f6d6fa68e636c6215de3ff7174e856e31cbae48392587ddc5902a37004a8878913f959eb7cd9381f6bc398a558828815890e807017e616496a839
SSDEEP 6144:lM9dvKEh5dUT+6LHX9kk33M/bOlTRBeBGGGJzm8Ul/lxg/zry:lM98iyknbsBfJXAqa
MD5 SHA1 SHA512 SSDEEP

Submit Download

apdate.exe

Path C:\Users\Admin\AppData\Roaming\apdate\apdate.exe
Size 2.1MB
SHA256 cfde16e103af9e59944d44d7f12e5755313948273cd64237df2dce50811866db
MD5 46f407da71637ad9654f4528fc06b504
SHA1 b682a05a1464e6a56a2334df1322bdb03cdbac1a
SHA512 10e01533192f6d6fa68e636c6215de3ff7174e856e31cbae48392587ddc5902a37004a8878913f959eb7cd9381f6bc398a558828815890e807017e616496a839
SSDEEP 6144:lM9dvKEh5dUT+6LHX9kk33M/bOlTRBeBGGGJzm8Ul/lxg/zry:lM98iyknbsBfJXAqa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2696-135-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/2696-137-0x0000000005A70000-0x0000000005B02000-memory.dmp

Download

memory/2696-138-0x00000000060C0000-0x0000000006664000-memory.dmp

Download

memory/2696-140-0x0000000006D00000-0x0000000006D9C000-memory.dmp

Download

memory/3268-130-0x00000000002D0000-0x00000000004E6000-memory.dmp

Download

memory/3268-131-0x0000000005140000-0x00000000051A6000-memory.dmp

Download

memory/4376-144-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Download

memory/4376-143-0x0000000005C00000-0x0000000005C22000-memory.dmp

Download

memory/4376-142-0x00000000055D0000-0x0000000005BF8000-memory.dmp

Download

memory/4376-141-0x0000000002A70000-0x0000000002AA6000-memory.dmp

Download

memory/4376-150-0x0000000006490000-0x00000000064AE000-memory.dmp

Download