masslogger | 02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340

General

Target

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
Size

981KB
MD5

6bf2cd8af0927301fce7c948e492c4cf
SHA1

fe87f5c8bc208d4355ac56629fbb341d5eb69a75
SHA256

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340
SHA512

23aff091ab819d2dd221b61497675454b64491b91c66af9637b841221bd113fa9ff21d0018e8677b6b727d344a954c7d62ded39af67beae5175c6a8106966f3f

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1804-134-0x0000000000B80000-0x0000000000C06000-memory.dmp	family_masslogger
behavioral2/memory/1804-135-0x0000000000B80000-0x0000000000C06000-memory.dmp	family_masslogger

Drops startup file 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fgghjvh.vbs notepad.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fgghjvh.vbs	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe

description	pid	process	target process
PID 5060 set thread context of 1804	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exepowershell.exe

pid	process
5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
4276	powershell.exe
4276	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe

pid process

5060 02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
Token: SeDebugPrivilege	4276	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe

description	pid	process	target process
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	notepad.exe
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	notepad.exe
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	notepad.exe
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	notepad.exe
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	notepad.exe
PID 5060 wrote to memory of 1804	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
PID 5060 wrote to memory of 1804	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
PID 5060 wrote to memory of 1804	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
PID 1804 wrote to memory of 4276	1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	powershell.exe
PID 1804 wrote to memory of 4276	1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	powershell.exe
PID 1804 wrote to memory of 4276	1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
"C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
2⤵
- Drops startup file
PID:3456

C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
"C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-138-0x0000000005410000-0x0000000005476000-memory.dmp

Filesize
408KB

Download
memory/1804-133-0x0000000000000000-mapping.dmp

Download
memory/1804-134-0x0000000000B80000-0x0000000000C06000-memory.dmp

Filesize
536KB

Download
memory/1804-135-0x0000000000B80000-0x0000000000C06000-memory.dmp

Filesize
536KB

Download
memory/1804-136-0x0000000004BF0000-0x0000000004C82000-memory.dmp

Filesize
584KB

Download
memory/1804-137-0x0000000004E60000-0x0000000005404000-memory.dmp

Filesize
5.6MB

Download
memory/3456-132-0x0000000000000000-mapping.dmp

Download
memory/4276-139-0x0000000000000000-mapping.dmp

Download
memory/4276-140-0x00000000047D0000-0x0000000004806000-memory.dmp

Filesize
216KB

Download
memory/4276-141-0x0000000004FB0000-0x00000000055D8000-memory.dmp

Filesize
6.2MB

Download
memory/4276-142-0x0000000004CB0000-0x0000000004CD2000-memory.dmp

Filesize
136KB

Download
memory/4276-143-0x0000000004E70000-0x0000000004ED6000-memory.dmp

Filesize
408KB

Download
memory/4276-144-0x0000000005D90000-0x0000000005DAE000-memory.dmp

Filesize
120KB

Download
memory/4276-145-0x00000000073F0000-0x0000000007A6A000-memory.dmp

Filesize
6.5MB

Download
memory/4276-146-0x0000000006290000-0x00000000062AA000-memory.dmp

Filesize
104KB

Download
memory/4276-147-0x0000000006E10000-0x0000000006EA6000-memory.dmp

Filesize
600KB

Download
memory/4276-148-0x0000000006380000-0x00000000063A2000-memory.dmp

Filesize
136KB

Download
memory/5060-131-0x0000000002420000-0x0000000002431000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads