masslogger | 0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7

General

Target

0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe
Size

801KB
MD5

acdf6a1ba69a3c47c10b477aca7573f8
SHA1

be7033f5e7ad87f70decc0d72dbce2a483f5852e
SHA256

0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7
SHA512

716810fba0d37906c9f8309c64a45f51764679c7c8a3c46df978aa94c82fc1708e9e04b478ead684ce07ae328790eb8ae4234f269aa57df4cdeaa9273b9d5859

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3412-133-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe

description	pid	process	target process
PID 1800 set thread context of 3412	1800	0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4368 powershell.exe
4368 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe

pid process

1800 0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegAsm.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3412 RegAsm.exe
Token: SeDebugPrivilege 4368 powershell.exe

pid	process
4368	powershell.exe
4368	powershell.exe

pid	process
1800	0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe

description	pid	process
Token: SeDebugPrivilege	3412	RegAsm.exe
Token: SeDebugPrivilege	4368	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exeRegAsm.execmd.exe

description	pid	process	target process
PID 1800 wrote to memory of 3412	1800	0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe	RegAsm.exe
PID 1800 wrote to memory of 3412	1800	0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe	RegAsm.exe
PID 1800 wrote to memory of 3412	1800	0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe	RegAsm.exe
PID 1800 wrote to memory of 3412	1800	0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe	RegAsm.exe
PID 3412 wrote to memory of 4104	3412	RegAsm.exe	cmd.exe
PID 3412 wrote to memory of 4104	3412	RegAsm.exe	cmd.exe
PID 3412 wrote to memory of 4104	3412	RegAsm.exe	cmd.exe
PID 4104 wrote to memory of 4368	4104	cmd.exe	powershell.exe
PID 4104 wrote to memory of 4368	4104	cmd.exe	powershell.exe
PID 4104 wrote to memory of 4368	4104	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe
"C:\Users\Admin\AppData\Local\Temp\0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-130-0x0000000000E60000-0x0000000000F2E000-memory.dmp

Filesize
824KB

Download
memory/1800-132-0x00000000018F0000-0x00000000018F3000-memory.dmp

Filesize
12KB

Download
memory/3412-131-0x0000000000000000-mapping.dmp

Download
memory/3412-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3412-134-0x0000000005460000-0x0000000005A04000-memory.dmp

Filesize
5.6MB

Download
memory/3412-135-0x0000000004DB0000-0x0000000004E4C000-memory.dmp

Filesize
624KB

Download
memory/3412-136-0x0000000005020000-0x0000000005086000-memory.dmp

Filesize
408KB

Download
memory/3412-137-0x0000000005130000-0x00000000051C2000-memory.dmp

Filesize
584KB

Download
memory/4104-138-0x0000000000000000-mapping.dmp

Download
memory/4368-139-0x0000000000000000-mapping.dmp

Download
memory/4368-140-0x0000000002290000-0x00000000022C6000-memory.dmp

Filesize
216KB

Download
memory/4368-141-0x0000000004D90000-0x00000000053B8000-memory.dmp

Filesize
6.2MB

Download
memory/4368-142-0x0000000004BF0000-0x0000000004C12000-memory.dmp

Filesize
136KB

Download
memory/4368-143-0x0000000004CA0000-0x0000000004D06000-memory.dmp

Filesize
408KB

Download
memory/4368-144-0x0000000004950000-0x000000000496E000-memory.dmp

Filesize
120KB

Download
memory/4368-145-0x0000000007410000-0x0000000007A8A000-memory.dmp

Filesize
6.5MB

Download
memory/4368-146-0x00000000060B0000-0x00000000060CA000-memory.dmp

Filesize
104KB

Download
memory/4368-147-0x0000000006E30000-0x0000000006EC6000-memory.dmp

Filesize
600KB

Download
memory/4368-148-0x0000000006180000-0x00000000061A2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads