masslogger | 4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800

General

Target

4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
Size

974KB
MD5

8089de419f5fc9e263ca1439a4b5245b
SHA1

e4e9e1bd91630cc702c862ceeac16215174249b4
SHA256

4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800
SHA512

715b3cf733554135292757a9942cdc6bf9682e2b54be8d9a03a668ce0e5e5bf1835320803ccc45a087866e2b03a7d189ff2d0a8e73244c88b03dfc15463300e7

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4388-136-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe

description	pid	process	target process
PID 1696 set thread context of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exepowershell.exe

pid	process
1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
4388	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
4388	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
1476	powershell.exe
1476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
Token: SeDebugPrivilege	4388	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
Token: SeDebugPrivilege	1476	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe

description	pid	process	target process
PID 1696 wrote to memory of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
PID 1696 wrote to memory of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
PID 1696 wrote to memory of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
PID 1696 wrote to memory of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
PID 1696 wrote to memory of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
PID 1696 wrote to memory of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
PID 1696 wrote to memory of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
PID 1696 wrote to memory of 4388	1696	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
PID 4388 wrote to memory of 1476	4388	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	powershell.exe
PID 4388 wrote to memory of 1476	4388	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	powershell.exe
PID 4388 wrote to memory of 1476	4388	4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
"C:\Users\Admin\AppData\Local\Temp\4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4a638a4493725c524ab6db6f0a41781d881aaccb305d90168c17023616b34800.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/1476-142-0x0000000004F10000-0x0000000004F32000-memory.dmp

Filesize
136KB

Download
memory/1476-140-0x00000000025B0000-0x00000000025E6000-memory.dmp

Filesize
216KB

Download
memory/1476-146-0x00000000062C0000-0x00000000062DA000-memory.dmp

Filesize
104KB

Download
memory/1476-145-0x0000000007570000-0x0000000007BEA000-memory.dmp

Filesize
6.5MB

Download
memory/1476-138-0x0000000000000000-mapping.dmp

Download
memory/1476-144-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Filesize
120KB

Download
memory/1476-143-0x00000000050B0000-0x0000000005116000-memory.dmp

Filesize
408KB

Download
memory/1476-141-0x0000000005160000-0x0000000005788000-memory.dmp

Filesize
6.2MB

Download
memory/1696-131-0x0000000005610000-0x0000000005BB4000-memory.dmp

Filesize
5.6MB

Download
memory/1696-130-0x0000000000560000-0x000000000065A000-memory.dmp

Filesize
1000KB

Download
memory/1696-132-0x0000000005060000-0x00000000050F2000-memory.dmp

Filesize
584KB

Download
memory/1696-134-0x0000000008A30000-0x0000000008ACC000-memory.dmp

Filesize
624KB

Download
memory/1696-133-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/4388-135-0x0000000000000000-mapping.dmp

Download
memory/4388-137-0x00000000053F0000-0x0000000005456000-memory.dmp

Filesize
408KB

Download
memory/4388-136-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads