masslogger | 41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62

Analysis

Target

41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe
Size

1005KB
MD5

076858b623a8627a598e7f0ce215a950
SHA1

9024597820f92fbe80387c2c29a3ef07c801b9ca
SHA256

41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62
SHA512

12defd0b32a8ac8b70627bef40c77b7f01cad4e62f2ef816bfd752684486ff396c1e1e87c49b4583492b654151e8f64f5e98bcf8173a4db337afbcd7337bd387

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2584-134-0x0000000000B00000-0x0000000000B86000-memory.dmp	family_masslogger
behavioral2/memory/2584-133-0x0000000000B00000-0x0000000000B86000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe

description	pid	process	target process
PID 1688 set thread context of 2584	1688	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe

pid	process
1688	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe
1688	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe

pid process

1688 41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe

description	pid	process	target process
PID 1688 wrote to memory of 2584	1688	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe
PID 1688 wrote to memory of 2584	1688	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe
PID 1688 wrote to memory of 2584	1688	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe	41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe

C:\Users\Admin\AppData\Local\Temp\41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe
"C:\Users\Admin\AppData\Local\Temp\41e8fe852c783b5c153b6524cc6d7e1c7977c8ebc83d846190f83c1fcf38df62.exe"
2⤵
PID:2584

memory/1688-131-0x0000000002330000-0x0000000002342000-memory.dmp

Filesize
72KB

Download
memory/2584-132-0x0000000000000000-mapping.dmp

Download
memory/2584-134-0x0000000000B00000-0x0000000000B86000-memory.dmp

Filesize
536KB

Download
memory/2584-133-0x0000000000B00000-0x0000000000B86000-memory.dmp

Filesize
536KB

Download