masslogger | ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b

General

Target

ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
Size

809KB
MD5

734692ac2adc2fab6b0574abab62949e
SHA1

e88d3050e9edb381bb40842c8ebe1a1bb27efe3c
SHA256

ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b
SHA512

953378a6fdf8d636a7277b113c558df0c91363cd87791804ba27f4aec0f2deda43f6969683958d0edec31d0555a48788f795e29b628ac9177d36c9b1c4d57f8d

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2128-138-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4384 set thread context of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
2128	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
2128	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
2576	powershell.exe
2576	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
Token: SeDebugPrivilege	2128	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
Token: SeDebugPrivilege	2576	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 2412	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	90
PID 4384 wrote to memory of 2412	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	90
PID 4384 wrote to memory of 2412	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	90
PID 4384 wrote to memory of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92
PID 4384 wrote to memory of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92
PID 4384 wrote to memory of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92
PID 4384 wrote to memory of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92
PID 4384 wrote to memory of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92
PID 4384 wrote to memory of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92
PID 4384 wrote to memory of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92
PID 4384 wrote to memory of 2128	4384	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	92
PID 2128 wrote to memory of 2576	2128	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	95
PID 2128 wrote to memory of 2576	2128	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	95
PID 2128 wrote to memory of 2576	2128	ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe	95

C:\Users\Admin\AppData\Local\Temp\ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
"C:\Users\Admin\AppData\Local\Temp\ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zJWeRCsAgdh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7753.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2412
- C:\Users\Admin\AppData\Local\Temp\ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ec551b4d1cea1117f5749502f290a4afdb193a66c93bb700ce7e6fc58985184b.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7753.tmp

Filesize
1KB

MD5
74a1ee76c55562da2121841cfb0e8785

SHA1
5bd737c691cf5e43927c30635062184a3a5b4e80

SHA256
122a44709c6b92a12cabbc6d4b2eaba244838088dbde8a149125ac29edf0a2c6

SHA512
7d74e8613df16dea4118cb254b06c27de5a7c03d98ac9b42a87f3b07eb6b3d63ceae3d5b234316fb7cbdda36fe97f49437861280fb6bda0fedc1847de3d25b5a

Download Submit
memory/2128-140-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Filesize
408KB

Download
memory/2128-138-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2576-142-0x00000000024B0000-0x00000000024E6000-memory.dmp

Filesize
216KB

Download
memory/2576-143-0x0000000004EE0000-0x0000000005508000-memory.dmp

Filesize
6.2MB

Download
memory/2576-144-0x00000000058E0000-0x0000000005902000-memory.dmp

Filesize
136KB

Download
memory/2576-145-0x0000000005D00000-0x0000000005D66000-memory.dmp

Filesize
408KB

Download
memory/2576-146-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

Filesize
120KB

Download
memory/2576-147-0x0000000007540000-0x0000000007BBA000-memory.dmp

Filesize
6.5MB

Download
memory/2576-148-0x0000000006360000-0x000000000637A000-memory.dmp

Filesize
104KB

Download
memory/4384-134-0x0000000009060000-0x00000000090FC000-memory.dmp

Filesize
624KB

Download
memory/4384-133-0x0000000005920000-0x000000000592A000-memory.dmp

Filesize
40KB

Download
memory/4384-132-0x0000000005880000-0x0000000005912000-memory.dmp

Filesize
584KB

Download
memory/4384-131-0x0000000005F40000-0x00000000064E4000-memory.dmp

Filesize
5.6MB

Download
memory/4384-130-0x0000000000E10000-0x0000000000EE0000-memory.dmp

Filesize
832KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads