masslogger | b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03

General

Target

b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
Size

1.1MB
MD5

c681559b99ec45b7deb597342f829ad1
SHA1

f9c264ea9987b2377293ebad0722b6389ffe4c99
SHA256

b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03
SHA512

804ff57a342d67c5126ea8b54c03afb031d7b51e814e633657e8e91ffdb3c09b2d0271b6649471c10dbdb0388d6f9816cdc3f649b9151916bf7c7fb3e74c388b

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1884-136-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe

description	pid	process	target process
PID 716 set thread context of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2712 schtasks.exe

pid	process
2712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exeb8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exepowershell.exe

pid	process
716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
1884	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
1884	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
2244	powershell.exe
2244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exeb8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
Token: SeDebugPrivilege	1884	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
Token: SeDebugPrivilege	2244	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exeb8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe

description	pid	process	target process
PID 716 wrote to memory of 2712	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	schtasks.exe
PID 716 wrote to memory of 2712	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	schtasks.exe
PID 716 wrote to memory of 2712	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	schtasks.exe
PID 716 wrote to memory of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
PID 716 wrote to memory of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
PID 716 wrote to memory of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
PID 716 wrote to memory of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
PID 716 wrote to memory of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
PID 716 wrote to memory of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
PID 716 wrote to memory of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
PID 716 wrote to memory of 1884	716	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
PID 1884 wrote to memory of 2244	1884	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	powershell.exe
PID 1884 wrote to memory of 2244	1884	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	powershell.exe
PID 1884 wrote to memory of 2244	1884	b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
"C:\Users\Admin\AppData\Local\Temp\b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TsWHapCjEjbp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp63AB.tmp"
2⤵
- Creates scheduled task(s)
PID:2712

C:\Users\Admin\AppData\Local\Temp\b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03.exe.log
Filesize
412B

MD5
e72888b5960716cf170f3e1becd14370

SHA1
0aeefd2d4a7948a03aad625ca86fc34d79adf248

SHA256
8317f594f74040b50e1b88f4aba5e6da3423bf47fe91df59e6e85f37b1f7e0ab

SHA512
9cdfda6fc4f324dfd8d53b46610114252431a5d26296a6f3d606b8ffeef172263fbde9ce0a1b2b9232dabcdabd33d6677e9a5f7693b175f24cea622c31b5c6b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp63AB.tmp
Filesize
1KB

MD5
a159eed62423d154ff84f20a72e2e582

SHA1
f9c16b4c89e444c6b76db4e639bb26715b635c8b

SHA256
5f89fd2f81d3912dfda9d891c060caee1e3ed620abe0b864da36873a0b2ae019

SHA512
3bffd53da18f082fbbaca7a2d9e4feae72153b37d19ff41f5c37a3dd920dd922b12473e35a3001d381f77c6b5a1dcc8fc7215890377ddebd1cc5f22b0118cb49

Download Submit
memory/716-130-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/716-131-0x0000000004DC0000-0x0000000004E5C000-memory.dmp

Filesize
624KB

Download
memory/716-132-0x0000000004E60000-0x0000000004EF2000-memory.dmp

Filesize
584KB

Download
memory/1884-135-0x0000000000000000-mapping.dmp

Download
memory/1884-136-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1884-137-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/1884-138-0x0000000005310000-0x0000000005376000-memory.dmp

Filesize
408KB

Download
memory/2244-142-0x0000000005C70000-0x0000000006298000-memory.dmp

Filesize
6.2MB

Download
memory/2244-141-0x0000000003000000-0x0000000003036000-memory.dmp

Filesize
216KB

Download
memory/2244-139-0x0000000000000000-mapping.dmp

Download
memory/2244-143-0x0000000005A70000-0x0000000005A92000-memory.dmp

Filesize
136KB

Download
memory/2244-144-0x00000000062A0000-0x0000000006306000-memory.dmp

Filesize
408KB

Download
memory/2244-145-0x0000000006930000-0x000000000694E000-memory.dmp

Filesize
120KB

Download
memory/2244-146-0x0000000007F70000-0x00000000085EA000-memory.dmp

Filesize
6.5MB

Download
memory/2244-147-0x0000000006E40000-0x0000000006E5A000-memory.dmp

Filesize
104KB

Download
memory/2244-148-0x0000000007B90000-0x0000000007C26000-memory.dmp

Filesize
600KB

Download
memory/2244-149-0x0000000006F10000-0x0000000006F32000-memory.dmp

Filesize
136KB

Download
memory/2712-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads