masslogger | 15b63ca9d3e50096a88629673a41e94690e235e740e2721c01e5291494299a93

General

Target

2020611-1006-Dross.exe
Size

801KB
MD5

acdf6a1ba69a3c47c10b477aca7573f8
SHA1

be7033f5e7ad87f70decc0d72dbce2a483f5852e
SHA256

0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7
SHA512

716810fba0d37906c9f8309c64a45f51764679c7c8a3c46df978aa94c82fc1708e9e04b478ead684ce07ae328790eb8ae4234f269aa57df4cdeaa9273b9d5859

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4560-133-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

2020611-1006-Dross.exe

description pid process target process

PID 4840 set thread context of 4560 4840 2020611-1006-Dross.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4920 powershell.exe
4920 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2020611-1006-Dross.exe

pid process

4840 2020611-1006-Dross.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegAsm.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4560 RegAsm.exe
Token: SeDebugPrivilege 4920 powershell.exe

description	pid	process	target process
PID 4840 set thread context of 4560	4840	2020611-1006-Dross.exe	RegAsm.exe

pid	process
4920	powershell.exe
4920	powershell.exe

pid	process
4840	2020611-1006-Dross.exe

description	pid	process
Token: SeDebugPrivilege	4560	RegAsm.exe
Token: SeDebugPrivilege	4920	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

2020611-1006-Dross.exeRegAsm.execmd.exe

description	pid	process	target process
PID 4840 wrote to memory of 4560	4840	2020611-1006-Dross.exe	RegAsm.exe
PID 4840 wrote to memory of 4560	4840	2020611-1006-Dross.exe	RegAsm.exe
PID 4840 wrote to memory of 4560	4840	2020611-1006-Dross.exe	RegAsm.exe
PID 4840 wrote to memory of 4560	4840	2020611-1006-Dross.exe	RegAsm.exe
PID 4560 wrote to memory of 3892	4560	RegAsm.exe	cmd.exe
PID 4560 wrote to memory of 3892	4560	RegAsm.exe	cmd.exe
PID 4560 wrote to memory of 3892	4560	RegAsm.exe	cmd.exe
PID 3892 wrote to memory of 4920	3892	cmd.exe	powershell.exe
PID 3892 wrote to memory of 4920	3892	cmd.exe	powershell.exe
PID 3892 wrote to memory of 4920	3892	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\2020611-1006-Dross.exe
"C:\Users\Admin\AppData\Local\Temp\2020611-1006-Dross.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-138-0x0000000000000000-mapping.dmp

Download
memory/4560-134-0x0000000005E30000-0x00000000063D4000-memory.dmp

Filesize
5.6MB

Download
memory/4560-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4560-131-0x0000000000000000-mapping.dmp

Download
memory/4560-137-0x0000000005B00000-0x0000000005B92000-memory.dmp

Filesize
584KB

Download
memory/4560-135-0x0000000005740000-0x00000000057DC000-memory.dmp

Filesize
624KB

Download
memory/4560-136-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/4840-132-0x0000000002E90000-0x0000000002E93000-memory.dmp

Filesize
12KB

Download
memory/4840-130-0x0000000000940000-0x0000000000A0E000-memory.dmp

Filesize
824KB

Download
memory/4920-141-0x00000000052F0000-0x0000000005918000-memory.dmp

Filesize
6.2MB

Download
memory/4920-140-0x0000000004B60000-0x0000000004B96000-memory.dmp

Filesize
216KB

Download
memory/4920-148-0x00000000066F0000-0x0000000006712000-memory.dmp

Filesize
136KB

Download
memory/4920-142-0x0000000005160000-0x0000000005182000-memory.dmp

Filesize
136KB

Download
memory/4920-143-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Filesize
408KB

Download
memory/4920-144-0x00000000060B0000-0x00000000060CE000-memory.dmp

Filesize
120KB

Download
memory/4920-145-0x0000000007980000-0x0000000007FFA000-memory.dmp

Filesize
6.5MB

Download
memory/4920-146-0x0000000006630000-0x000000000664A000-memory.dmp

Filesize
104KB

Download
memory/4920-147-0x00000000073A0000-0x0000000007436000-memory.dmp

Filesize
600KB

Download
memory/4920-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads