masslogger | d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517

General

Target

d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
Size

1.1MB
MD5

bd0f466d4430c91d4b594be6a1842a25
SHA1

54ee4c4163b7e1ebf7bfa9e431faa0cb4cbcb6f9
SHA256

d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517
SHA512

7f60b6b308183c526e691e4e9db7d2da79f41329a71cc654c88f9a3e3162a503543e47cb611e8bbc607d488f0f49d4c12c02d0202eab71db37ff8a4b3cf32ec4

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5100-134-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe

description	pid	process	target process
PID 4188 set thread context of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exed3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exepowershell.exe

pid	process
4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
5100	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
5100	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
4036	powershell.exe
4036	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exed3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
Token: SeDebugPrivilege	5100	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
Token: SeDebugPrivilege	4036	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exed3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe

description	pid	process	target process
PID 4188 wrote to memory of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
PID 4188 wrote to memory of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
PID 4188 wrote to memory of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
PID 4188 wrote to memory of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
PID 4188 wrote to memory of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
PID 4188 wrote to memory of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
PID 4188 wrote to memory of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
PID 4188 wrote to memory of 5100	4188	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
PID 5100 wrote to memory of 4036	5100	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	powershell.exe
PID 5100 wrote to memory of 4036	5100	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	powershell.exe
PID 5100 wrote to memory of 4036	5100	d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
"C:\Users\Admin\AppData\Local\Temp\d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188

C:\Users\Admin\AppData\Local\Temp\d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d3927bb8ff26df08ec9d4f9adce917cfde227c7b4a56d169713e15de8e748517.exe.log

Filesize
412B

MD5
e72888b5960716cf170f3e1becd14370

SHA1
0aeefd2d4a7948a03aad625ca86fc34d79adf248

SHA256
8317f594f74040b50e1b88f4aba5e6da3423bf47fe91df59e6e85f37b1f7e0ab

SHA512
9cdfda6fc4f324dfd8d53b46610114252431a5d26296a6f3d606b8ffeef172263fbde9ce0a1b2b9232dabcdabd33d6677e9a5f7693b175f24cea622c31b5c6b7

Download Submit
memory/4036-142-0x0000000005BE0000-0x0000000005C46000-memory.dmp

Filesize
408KB

Download
memory/4036-144-0x0000000007C20000-0x000000000829A000-memory.dmp

Filesize
6.5MB

Download
memory/4036-139-0x0000000004E50000-0x0000000004E86000-memory.dmp

Filesize
216KB

Download
memory/4036-147-0x0000000006990000-0x00000000069B2000-memory.dmp

Filesize
136KB

Download
memory/4036-140-0x00000000054C0000-0x0000000005AE8000-memory.dmp

Filesize
6.2MB

Download
memory/4036-137-0x0000000000000000-mapping.dmp

Download
memory/4036-141-0x0000000005400000-0x0000000005422000-memory.dmp

Filesize
136KB

Download
memory/4036-146-0x0000000007640000-0x00000000076D6000-memory.dmp

Filesize
600KB

Download
memory/4036-145-0x00000000068C0000-0x00000000068DA000-memory.dmp

Filesize
104KB

Download
memory/4036-143-0x00000000063D0000-0x00000000063EE000-memory.dmp

Filesize
120KB

Download
memory/4188-132-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/4188-131-0x0000000004F50000-0x0000000004FEC000-memory.dmp

Filesize
624KB

Download
memory/4188-130-0x00000000004D0000-0x00000000005F0000-memory.dmp

Filesize
1.1MB

Download
memory/5100-136-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Filesize
408KB

Download
memory/5100-135-0x0000000006090000-0x0000000006634000-memory.dmp

Filesize
5.6MB

Download
memory/5100-133-0x0000000000000000-mapping.dmp

Download
memory/5100-134-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads