masslogger | 15b63ca9d3e50096a88629673a41e94690e235e740e2721c01e5291494299a93

General

Target

2020611-1006-Dross.exe
Size

801KB
MD5

acdf6a1ba69a3c47c10b477aca7573f8
SHA1

be7033f5e7ad87f70decc0d72dbce2a483f5852e
SHA256

0c88fe3c8c89f147793600dc852e380edf17219d55c84d9894420659ff81b6b7
SHA512

716810fba0d37906c9f8309c64a45f51764679c7c8a3c46df978aa94c82fc1708e9e04b478ead684ce07ae328790eb8ae4234f269aa57df4cdeaa9273b9d5859

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4560-133-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 4560	4840	2020611-1006-Dross.exe	77

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4920	powershell.exe
4920	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4840	2020611-1006-Dross.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	RegAsm.exe
Token: SeDebugPrivilege	4920	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4560	4840	2020611-1006-Dross.exe	77
PID 4840 wrote to memory of 4560	4840	2020611-1006-Dross.exe	77
PID 4840 wrote to memory of 4560	4840	2020611-1006-Dross.exe	77
PID 4840 wrote to memory of 4560	4840	2020611-1006-Dross.exe	77
PID 4560 wrote to memory of 3892	4560	RegAsm.exe	78
PID 4560 wrote to memory of 3892	4560	RegAsm.exe	78
PID 4560 wrote to memory of 3892	4560	RegAsm.exe	78
PID 3892 wrote to memory of 4920	3892	cmd.exe	80
PID 3892 wrote to memory of 4920	3892	cmd.exe	80
PID 3892 wrote to memory of 4920	3892	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\2020611-1006-Dross.exe
"C:\Users\Admin\AppData\Local\Temp\2020611-1006-Dross.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4560-134-0x0000000005E30000-0x00000000063D4000-memory.dmp

Filesize
5.6MB

Download
memory/4560-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4560-137-0x0000000005B00000-0x0000000005B92000-memory.dmp

Filesize
584KB

Download
memory/4560-135-0x0000000005740000-0x00000000057DC000-memory.dmp

Filesize
624KB

Download
memory/4560-136-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/4840-132-0x0000000002E90000-0x0000000002E93000-memory.dmp

Filesize
12KB

Download
memory/4840-130-0x0000000000940000-0x0000000000A0E000-memory.dmp

Filesize
824KB

Download
memory/4920-141-0x00000000052F0000-0x0000000005918000-memory.dmp

Filesize
6.2MB

Download
memory/4920-140-0x0000000004B60000-0x0000000004B96000-memory.dmp

Filesize
216KB

Download
memory/4920-148-0x00000000066F0000-0x0000000006712000-memory.dmp

Filesize
136KB

Download
memory/4920-142-0x0000000005160000-0x0000000005182000-memory.dmp

Filesize
136KB

Download
memory/4920-143-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Filesize
408KB

Download
memory/4920-144-0x00000000060B0000-0x00000000060CE000-memory.dmp

Filesize
120KB

Download
memory/4920-145-0x0000000007980000-0x0000000007FFA000-memory.dmp

Filesize
6.5MB

Download
memory/4920-146-0x0000000006630000-0x000000000664A000-memory.dmp

Filesize
104KB

Download
memory/4920-147-0x00000000073A0000-0x0000000007436000-memory.dmp

Filesize
600KB

Download

Analysis

Sharing