masslogger | e98968f1589b8053634f973297a144deb8772c01acf510be339ef041b66f085d

Analysis

max time kernel
61s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HALKBANK.exe
Size

2.6MB
MD5

c291db2a12b8b6cac2a34c15f3ebd92e
SHA1

552ecf8af82f538b251e42f0ad3e1a45f7144887
SHA256

dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722
SHA512

6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Score

10^/10

masslogger persistence spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/800-54-0x0000000000A30000-0x0000000000CCC000-memory.dmp	family_masslogger
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe	family_masslogger
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe	family_masslogger
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe	family_masslogger
behavioral1/memory/1428-94-0x0000000000270000-0x000000000050C000-memory.dmp	family_masslogger
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe	family_masslogger
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe	family_masslogger
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe	family_masslogger
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe	family_masslogger
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe	family_masslogger

Executes dropped EXE 3 IoCs

Processes:

RegAsm.exefirefoxx.exeRegAsm.exe

pid process

2044 RegAsm.exe
1428 firefoxx.exe
1152 RegAsm.exe

pid	process
2044	RegAsm.exe
1428	firefoxx.exe
1152	RegAsm.exe

Loads dropped DLL 10 IoCs

Processes:

HALKBANK.exeRegAsm.exefirefoxx.exeRegAsm.exeWerFault.exe

pid	process
800	HALKBANK.exe
2044	RegAsm.exe
800	HALKBANK.exe
1428	firefoxx.exe
1152	RegAsm.exe
468	WerFault.exe
468	WerFault.exe
468	WerFault.exe
468	WerFault.exe
468	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefoxx = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\firefoxx.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

HALKBANK.exefirefoxx.exe

description	pid	process	target process
PID 800 set thread context of 2044	800	HALKBANK.exe	RegAsm.exe
PID 1428 set thread context of 1152	1428	firefoxx.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

468 1428 WerFault.exe firefoxx.exe

pid	pid_target	process	target process
468	1428	WerFault.exe	firefoxx.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

HALKBANK.exefirefoxx.exeRegAsm.exe

pid	process
800	HALKBANK.exe
800	HALKBANK.exe
800	HALKBANK.exe
800	HALKBANK.exe
1428	firefoxx.exe
1428	firefoxx.exe
1428	firefoxx.exe
1152	RegAsm.exe
1428	firefoxx.exe
1428	firefoxx.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

HALKBANK.exefirefoxx.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 800 HALKBANK.exe
Token: SeDebugPrivilege 1428 firefoxx.exe
Token: SeDebugPrivilege 1152 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	800	HALKBANK.exe
Token: SeDebugPrivilege	1428	firefoxx.exe
Token: SeDebugPrivilege	1152	RegAsm.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

HALKBANK.execmd.exefirefoxx.exe

description	pid	process	target process
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 2044	800	HALKBANK.exe	RegAsm.exe
PID 800 wrote to memory of 1144	800	HALKBANK.exe	cmd.exe
PID 800 wrote to memory of 1144	800	HALKBANK.exe	cmd.exe
PID 800 wrote to memory of 1144	800	HALKBANK.exe	cmd.exe
PID 800 wrote to memory of 1144	800	HALKBANK.exe	cmd.exe
PID 1144 wrote to memory of 1736	1144	cmd.exe	reg.exe
PID 1144 wrote to memory of 1736	1144	cmd.exe	reg.exe
PID 1144 wrote to memory of 1736	1144	cmd.exe	reg.exe
PID 1144 wrote to memory of 1736	1144	cmd.exe	reg.exe
PID 800 wrote to memory of 1428	800	HALKBANK.exe	firefoxx.exe
PID 800 wrote to memory of 1428	800	HALKBANK.exe	firefoxx.exe
PID 800 wrote to memory of 1428	800	HALKBANK.exe	firefoxx.exe
PID 800 wrote to memory of 1428	800	HALKBANK.exe	firefoxx.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 1152	1428	firefoxx.exe	RegAsm.exe
PID 1428 wrote to memory of 468	1428	firefoxx.exe	WerFault.exe
PID 1428 wrote to memory of 468	1428	firefoxx.exe	WerFault.exe
PID 1428 wrote to memory of 468	1428	firefoxx.exe	WerFault.exe
PID 1428 wrote to memory of 468	1428	firefoxx.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\HALKBANK.exe
"C:\Users\Admin\AppData\Local\Temp\HALKBANK.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v firefoxx /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v firefoxx /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe"
3⤵
- Adds Run key to start application
PID:1736

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 704
3⤵
- Loads dropped DLL
- Program crash
PID:468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe

Filesize
2.6MB

MD5
c291db2a12b8b6cac2a34c15f3ebd92e

SHA1
552ecf8af82f538b251e42f0ad3e1a45f7144887

SHA256
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722

SHA512
6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe

Filesize
2.6MB

MD5
c291db2a12b8b6cac2a34c15f3ebd92e

SHA1
552ecf8af82f538b251e42f0ad3e1a45f7144887

SHA256
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722

SHA512
6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe

Filesize
2.6MB

MD5
c291db2a12b8b6cac2a34c15f3ebd92e

SHA1
552ecf8af82f538b251e42f0ad3e1a45f7144887

SHA256
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722

SHA512
6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe

Filesize
2.6MB

MD5
c291db2a12b8b6cac2a34c15f3ebd92e

SHA1
552ecf8af82f538b251e42f0ad3e1a45f7144887

SHA256
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722

SHA512
6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe

Filesize
2.6MB

MD5
c291db2a12b8b6cac2a34c15f3ebd92e

SHA1
552ecf8af82f538b251e42f0ad3e1a45f7144887

SHA256
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722

SHA512
6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe

Filesize
2.6MB

MD5
c291db2a12b8b6cac2a34c15f3ebd92e

SHA1
552ecf8af82f538b251e42f0ad3e1a45f7144887

SHA256
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722

SHA512
6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe

Filesize
2.6MB

MD5
c291db2a12b8b6cac2a34c15f3ebd92e

SHA1
552ecf8af82f538b251e42f0ad3e1a45f7144887

SHA256
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722

SHA512
6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\firefoxx.exe

Filesize
2.6MB

MD5
c291db2a12b8b6cac2a34c15f3ebd92e

SHA1
552ecf8af82f538b251e42f0ad3e1a45f7144887

SHA256
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722

SHA512
6d63e75a2348659fff3d50062dcafef922bcb0385e148b5d93c61671134a639b51e491dbde4b3b18aed6adc87f24549b8cc1b42eb3b249ba7eb628b33f1f1392

Download Submit
memory/468-132-0x0000000000000000-mapping.dmp

Download
memory/800-54-0x0000000000A30000-0x0000000000CCC000-memory.dmp

Filesize
2.6MB

Download
memory/800-56-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/800-55-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/1144-88-0x0000000000000000-mapping.dmp

Download
memory/1152-126-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1152-103-0x00000000004A1F8E-mapping.dmp

Download
memory/1152-128-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1152-129-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1152-131-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1428-91-0x0000000000000000-mapping.dmp

Download
memory/1428-94-0x0000000000270000-0x000000000050C000-memory.dmp

Filesize
2.6MB

Download
memory/1736-89-0x0000000000000000-mapping.dmp

Download
memory/2044-81-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-86-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-85-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-83-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-61-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-72-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/2044-58-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-70-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-68-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-59-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-65-0x00000000004A1F8E-mapping.dmp

Download
memory/2044-64-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2044-63-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download