masslogger | b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4

General

Target

b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
Size

1.1MB
MD5

5bf1809efee424da32006e4f83b75082
SHA1

37ff3356852a25fe9523a42608e73594a2e7df2c
SHA256

b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4
SHA512

9b12387e28bc2f0c6ddbc0f4837be966a0b79394536b80d99aecfd9d45e8ec6b4dadb74f41f751f161ec7cca93df3ba1141c20c9142bdc9f78a0a30e836eaa59

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1804-135-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe

description	pid	process	target process
PID 1228 set thread context of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exeb40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exepowershell.exe

pid	process
1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
1804	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
1804	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
1336	powershell.exe
1336	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exeb40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
Token: SeDebugPrivilege	1804	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
Token: SeDebugPrivilege	1336	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exeb40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe

description	pid	process	target process
PID 1228 wrote to memory of 1440	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1440	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1440	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1228 wrote to memory of 1804	1228	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
PID 1804 wrote to memory of 1336	1804	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	powershell.exe
PID 1804 wrote to memory of 1336	1804	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	powershell.exe
PID 1804 wrote to memory of 1336	1804	b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
"C:\Users\Admin\AppData\Local\Temp\b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
"{path}"
2⤵
PID:1440

C:\Users\Admin\AppData\Local\Temp\b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b40856677db5bc7c1f038452b8d1bc42eb805aae103dc3fc2bc8a6c1b1deb7e4.exe.log

Filesize
412B

MD5
e72888b5960716cf170f3e1becd14370

SHA1
0aeefd2d4a7948a03aad625ca86fc34d79adf248

SHA256
8317f594f74040b50e1b88f4aba5e6da3423bf47fe91df59e6e85f37b1f7e0ab

SHA512
9cdfda6fc4f324dfd8d53b46610114252431a5d26296a6f3d606b8ffeef172263fbde9ce0a1b2b9232dabcdabd33d6677e9a5f7693b175f24cea622c31b5c6b7

Download Submit
memory/1228-130-0x0000000000D60000-0x0000000000E7C000-memory.dmp

Filesize
1.1MB

Download
memory/1228-131-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/1228-132-0x0000000005910000-0x00000000059A2000-memory.dmp

Filesize
584KB

Download
memory/1336-139-0x0000000000000000-mapping.dmp

Download
memory/1336-148-0x0000000006F20000-0x0000000006F42000-memory.dmp

Filesize
136KB

Download
memory/1336-147-0x0000000006FC0000-0x0000000007056000-memory.dmp

Filesize
600KB

Download
memory/1336-146-0x0000000006E50000-0x0000000006E6A000-memory.dmp

Filesize
104KB

Download
memory/1336-145-0x0000000007520000-0x0000000007B9A000-memory.dmp

Filesize
6.5MB

Download
memory/1336-140-0x00000000023F0000-0x0000000002426000-memory.dmp

Filesize
216KB

Download
memory/1336-141-0x0000000004EE0000-0x0000000005508000-memory.dmp

Filesize
6.2MB

Download
memory/1336-142-0x00000000056B0000-0x00000000056D2000-memory.dmp

Filesize
136KB

Download
memory/1336-143-0x0000000005850000-0x00000000058B6000-memory.dmp

Filesize
408KB

Download
memory/1336-144-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Filesize
120KB

Download
memory/1440-133-0x0000000000000000-mapping.dmp

Download
memory/1804-134-0x0000000000000000-mapping.dmp

Download
memory/1804-138-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/1804-137-0x00000000064A0000-0x0000000006A44000-memory.dmp

Filesize
5.6MB

Download
memory/1804-135-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads