masslogger | 13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc

General

Target

13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe
Size

791KB
MD5

5e11af4f190392e322373d783fd96c5b
SHA1

c94ae027e5173e8da1eb79be7bb5104d753c0be5
SHA256

13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc
SHA512

30f65950133a043ecf5e04e19581ad6864bbcd55325cb92c5ea6fde65b02852d0606f47872d181487eb1da3e10121470982f081b9c26d406e4978b23035dd2ee

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1144-137-0x0000000000400000-0x000000000049A000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1208 set thread context of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1784	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1784	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	85
PID 1208 wrote to memory of 1784	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	85
PID 1208 wrote to memory of 1784	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	85
PID 1208 wrote to memory of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87
PID 1208 wrote to memory of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87
PID 1208 wrote to memory of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87
PID 1208 wrote to memory of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87
PID 1208 wrote to memory of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87
PID 1208 wrote to memory of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87
PID 1208 wrote to memory of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87
PID 1208 wrote to memory of 1144	1208	13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe	87

C:\Users\Admin\AppData\Local\Temp\13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe
"C:\Users\Admin\AppData\Local\Temp\13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UAozUjJAzuCCO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC8C9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe
  "{path}"
  2⤵
  PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\13d8e46cccc3b937a3afad91418e79d55e416264213ad34ede6d3d662f0e6dbc.exe.log

Filesize
507B

MD5
76ffb2f33cb32ade8fc862a67599e9d8

SHA1
920cc4ab75b36d2f9f6e979b74db568973c49130

SHA256
f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310

SHA512
f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC8C9.tmp

Filesize
1KB

MD5
3573c863ab3146382f35cbb0b919282d

SHA1
b5a4a81b1e28585f03b2cb0e6cc1d4b4494a9827

SHA256
c185901c2d206fb23ca9f9ce8a485e7ac315064717faf991bbb0a37206c9a808

SHA512
baf9f260ded4cca3b576ade880de2ce688123ec906499a0a60cb6408988fd57c9744b2f8b054123615e18c594c20cb7e6a4feca5a5e51be3e82376d20421d398

Download Submit
memory/1144-137-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1144-139-0x0000000005640000-0x00000000056A6000-memory.dmp

Filesize
408KB

Download
memory/1208-130-0x00000000003F0000-0x00000000004BC000-memory.dmp

Filesize
816KB

Download
memory/1208-131-0x00000000053C0000-0x0000000005964000-memory.dmp

Filesize
5.6MB

Download
memory/1208-132-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Filesize
584KB

Download
memory/1208-133-0x0000000004F50000-0x0000000004FEC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads