masslogger | 18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689

General

Target

18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
Size

808KB
MD5

d239a049a6e4eb2cb428d7905a98ac37
SHA1

58ae995ee60b72fdac3c46caca6b2e4e5f65b847
SHA256

18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689
SHA512

4ea8e18c6e321aecbbca84afd6637e9442193e79638502af77fff54edbda98038af9a35d2e838fd5cbed34da50d08c051f2653dbffb8abb6201dd15250a0bc6c

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2888-137-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

65 api.ipify.org

flow	ioc
65	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

description	pid	process	target process
PID 5048 set thread context of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

pid	process
5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
2888	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
2888	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

description	pid	process
Token: SeDebugPrivilege	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
Token: SeDebugPrivilege	2888	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

description	pid	process	target process
PID 5048 wrote to memory of 2440	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2440	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2440	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
PID 5048 wrote to memory of 2888	5048	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe	18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe

C:\Users\Admin\AppData\Local\Temp\18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
"C:\Users\Admin\AppData\Local\Temp\18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048

C:\Users\Admin\AppData\Local\Temp\18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
"{path}"
2⤵
PID:2440

C:\Users\Admin\AppData\Local\Temp\18f4035381c01ac7eba826bf786103b091ce6f0c05943722a2996dbf14744689.exe
"{path}"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-135-0x0000000000000000-mapping.dmp

Download
memory/2888-136-0x0000000000000000-mapping.dmp

Download
memory/2888-137-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2888-138-0x0000000006CB0000-0x0000000006D16000-memory.dmp

Filesize
408KB

Download
memory/5048-130-0x0000000000D10000-0x0000000000DE0000-memory.dmp

Filesize
832KB

Download
memory/5048-131-0x0000000005AF0000-0x0000000006094000-memory.dmp

Filesize
5.6MB

Download
memory/5048-132-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/5048-133-0x00000000056F0000-0x00000000056FA000-memory.dmp

Filesize
40KB

Download
memory/5048-134-0x0000000008E40000-0x0000000008EDC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads