masslogger | c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759

Analysis

max time kernel
213s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08/05/2022, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
Size 878KB
Sample220508-g8hsmshdb9
SHA256 c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759
MD5 6705c4aef8d6d7e31be9d147a677dd7b
SHA1 e4bf30e9da36c02ec216f0f1465c8e4056a02b4b
SHA512 d1bbd8685a7551f00f2deef84309f8f0dcefe062e217157e45107fd0fb07f533f0adcc8faf5ee1ea66d088105ff6615370968c159fddfe68e96f047b7beeede9
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4108-136-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4556 set thread context of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
4108	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
4108	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
396	powershell.exe
396	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
Token: SeDebugPrivilege	4108	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
Token: SeDebugPrivilege	396	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84
PID 4556 wrote to memory of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84
PID 4556 wrote to memory of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84
PID 4556 wrote to memory of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84
PID 4556 wrote to memory of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84
PID 4556 wrote to memory of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84
PID 4556 wrote to memory of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84
PID 4556 wrote to memory of 4108	4556	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	84
PID 4108 wrote to memory of 396	4108	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	86
PID 4108 wrote to memory of 396	4108	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	86
PID 4108 wrote to memory of 396	4108	c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe	86

C:\Users\Admin\AppData\Local\Temp\c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
"C:\Users\Admin\AppData\Local\Temp\c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c944efbba0e619af9ebaff5e1df9e59177ee99784e366036c31aea48c8a6e759.exe.log
Size 1KB
SHA256 cb5dcf594045c8b7a5f87e8a12eabbd3e53e673654926027627ed79ef3e2a203
MD5 6dcfdb496c3cf0a736b09292618b380d
SHA1 59d3aecbd319c9b48d500b51a093ee48d02af334
SHA512 9b7d22dc9e40d11693f7191f7b075a78974322af145010e66b19d989e678477dfe4741e88d02929d5b37236276f4605bc23a7adbedf43b66cd3c4e5e7b7e67ff
MD5 SHA1 SHA512

Submit Download

memory/396-141-0x0000000005340000-0x0000000005968000-memory.dmp

Download

memory/396-148-0x0000000006860000-0x0000000006882000-memory.dmp

Download

memory/396-147-0x0000000007320000-0x00000000073B6000-memory.dmp

Download

memory/396-146-0x0000000006790000-0x00000000067AA000-memory.dmp

Download

memory/396-145-0x0000000007900000-0x0000000007F7A000-memory.dmp

Download

memory/396-144-0x00000000062A0000-0x00000000062BE000-memory.dmp

Download

memory/396-143-0x0000000005B20000-0x0000000005B86000-memory.dmp

Download

memory/396-142-0x0000000005310000-0x0000000005332000-memory.dmp

Download

memory/396-140-0x0000000004CD0000-0x0000000004D06000-memory.dmp

Download

memory/4108-138-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/4108-136-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4556-130-0x0000000000E90000-0x0000000000F72000-memory.dmp

Download

memory/4556-134-0x000000000E370000-0x000000000E40C000-memory.dmp

Download

memory/4556-133-0x00000000057F0000-0x00000000057FA000-memory.dmp

Download

memory/4556-132-0x0000000005860000-0x00000000058F2000-memory.dmp

Download

memory/4556-131-0x0000000005D70000-0x0000000006314000-memory.dmp

Download