masslogger | 02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340

General

Target

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
Size

981KB
MD5

6bf2cd8af0927301fce7c948e492c4cf
SHA1

fe87f5c8bc208d4355ac56629fbb341d5eb69a75
SHA256

02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340
SHA512

23aff091ab819d2dd221b61497675454b64491b91c66af9637b841221bd113fa9ff21d0018e8677b6b727d344a954c7d62ded39af67beae5175c6a8106966f3f

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1804-134-0x0000000000B80000-0x0000000000C06000-memory.dmp	family_masslogger
behavioral2/memory/1804-135-0x0000000000B80000-0x0000000000C06000-memory.dmp	family_masslogger

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fgghjvh.vbs	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 1804	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	83

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
4276	powershell.exe
4276	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
Token: SeDebugPrivilege	4276	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	82
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	82
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	82
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	82
PID 5060 wrote to memory of 3456	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	82
PID 5060 wrote to memory of 1804	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	83
PID 5060 wrote to memory of 1804	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	83
PID 5060 wrote to memory of 1804	5060	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	83
PID 1804 wrote to memory of 4276	1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	94
PID 1804 wrote to memory of 4276	1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	94
PID 1804 wrote to memory of 4276	1804	02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe	94

C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
"C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:3456
- C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe
  "C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\02ee841cf0dc2fdbe7df4b02336efe056e7c278681600eb3ab9b4bdde10bc340.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276

memory/1804-138-0x0000000005410000-0x0000000005476000-memory.dmp

Filesize
408KB

Download
memory/1804-134-0x0000000000B80000-0x0000000000C06000-memory.dmp

Filesize
536KB

Download
memory/1804-135-0x0000000000B80000-0x0000000000C06000-memory.dmp

Filesize
536KB

Download
memory/1804-136-0x0000000004BF0000-0x0000000004C82000-memory.dmp

Filesize
584KB

Download
memory/1804-137-0x0000000004E60000-0x0000000005404000-memory.dmp

Filesize
5.6MB

Download
memory/4276-140-0x00000000047D0000-0x0000000004806000-memory.dmp

Filesize
216KB

Download
memory/4276-141-0x0000000004FB0000-0x00000000055D8000-memory.dmp

Filesize
6.2MB

Download
memory/4276-142-0x0000000004CB0000-0x0000000004CD2000-memory.dmp

Filesize
136KB

Download
memory/4276-143-0x0000000004E70000-0x0000000004ED6000-memory.dmp

Filesize
408KB

Download
memory/4276-144-0x0000000005D90000-0x0000000005DAE000-memory.dmp

Filesize
120KB

Download
memory/4276-145-0x00000000073F0000-0x0000000007A6A000-memory.dmp

Filesize
6.5MB

Download
memory/4276-146-0x0000000006290000-0x00000000062AA000-memory.dmp

Filesize
104KB

Download
memory/4276-147-0x0000000006E10000-0x0000000006EA6000-memory.dmp

Filesize
600KB

Download
memory/4276-148-0x0000000006380000-0x00000000063A2000-memory.dmp

Filesize
136KB

Download
memory/5060-131-0x0000000002420000-0x0000000002431000-memory.dmp

Filesize
68KB

Download