masslogger | 5a7b4a2c621603832c1e73ad6d7ad022c260daaca1ea193a5e0ecca3bc5609d3

General

Target

BL_0003.exe
Size

813KB
MD5

e62ddd8facfe9707b2f56fd60bb09266
SHA1

7c3e04a6eb2252a38b50b237ba201114bdfaf346
SHA256

eb3d6a6bfec90855240b6e239a10d283ecf13b118e9b769e2f4100b3eec76a12
SHA512

50022648bc29f6cdcb20a6e640848908d35785e463056efbfc06e2666b1015589e156b4a82dd25c33252d566d638f2ab0f0e059ce36f58e2f84e02d0b382224e

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1956-136-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BL_0003.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	BL_0003.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

BL_0003.exe

description pid process target process

PID 4776 set thread context of 1956 4776 BL_0003.exe BL_0003.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4368 schtasks.exe

description	pid	process	target process
PID 4776 set thread context of 1956	4776	BL_0003.exe	BL_0003.exe

pid	process
4368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

BL_0003.exepowershell.exe

pid	process
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
492	powershell.exe
492	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

BL_0003.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4776 BL_0003.exe
Token: SeDebugPrivilege 492 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4776	BL_0003.exe
Token: SeDebugPrivilege	492	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

BL_0003.exeBL_0003.execmd.exe

description	pid	process	target process
PID 4776 wrote to memory of 4368	4776	BL_0003.exe	schtasks.exe
PID 4776 wrote to memory of 4368	4776	BL_0003.exe	schtasks.exe
PID 4776 wrote to memory of 4368	4776	BL_0003.exe	schtasks.exe
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	BL_0003.exe
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	BL_0003.exe
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	BL_0003.exe
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	BL_0003.exe
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	BL_0003.exe
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	BL_0003.exe
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	BL_0003.exe
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	BL_0003.exe
PID 1956 wrote to memory of 4252	1956	BL_0003.exe	cmd.exe
PID 1956 wrote to memory of 4252	1956	BL_0003.exe	cmd.exe
PID 1956 wrote to memory of 4252	1956	BL_0003.exe	cmd.exe
PID 4252 wrote to memory of 492	4252	cmd.exe	powershell.exe
PID 4252 wrote to memory of 492	4252	cmd.exe	powershell.exe
PID 4252 wrote to memory of 492	4252	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\BL_0003.exe
"C:\Users\Admin\AppData\Local\Temp\BL_0003.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fauItV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AE6.tmp"
2⤵
- Creates scheduled task(s)
PID:4368

C:\Users\Admin\AppData\Local\Temp\BL_0003.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\BL_0003.exe' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:4252

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\BL_0003.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BL_0003.exe.log
Filesize
412B

MD5
ad1c7f6525cfeb54c0487efd38b0e26c

SHA1
ed3da94723ac7e3828a9e93d68418bb810592f3b

SHA256
0a534a3d0fa82e6a427164c5f6e702cac7e4afc9967af9bc5ddba4f84ab33276

SHA512
48d625e6be5391d91d95c2850226fe39bb2411cb72139797699cfe126e6b066182e83950a8ea67e63b64a66b0d45f58d8bc97cab0363d55c2fd88c0d1d28009c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3AE6.tmp
Filesize
1KB

MD5
7a14eede73b08d78ab2d87985ddfd95b

SHA1
d4e54016e70c1d9adf3264b790a124add1d1bd73

SHA256
ce2dea444830cd4629026df83cbd8f1d5cce96b8cdef1324c574bb06d232cfda

SHA512
c2c554d47f70f982cba9c6753be7a7d371c5de4e75e9ebb130b31b12808800dd9b9a33511652b5ddaf4b67e007b781adfe3860ecc41d1d03985e50bbf34db20b

Download Submit
memory/492-142-0x0000000004590000-0x00000000045C6000-memory.dmp

Filesize
216KB

Download
memory/492-150-0x0000000006100000-0x0000000006122000-memory.dmp

Filesize
136KB

Download
memory/492-149-0x0000000006DA0000-0x0000000006E36000-memory.dmp

Filesize
600KB

Download
memory/492-148-0x0000000006020000-0x000000000603A000-memory.dmp

Filesize
104KB

Download
memory/492-147-0x0000000007180000-0x00000000077FA000-memory.dmp

Filesize
6.5MB

Download
memory/492-146-0x0000000005B20000-0x0000000005B3E000-memory.dmp

Filesize
120KB

Download
memory/492-145-0x0000000005420000-0x0000000005486000-memory.dmp

Filesize
408KB

Download
memory/492-144-0x0000000005380000-0x00000000053A2000-memory.dmp

Filesize
136KB

Download
memory/492-143-0x0000000004C60000-0x0000000005288000-memory.dmp

Filesize
6.2MB

Download
memory/492-141-0x0000000000000000-mapping.dmp

Download
memory/1956-135-0x0000000000000000-mapping.dmp

Download
memory/1956-139-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/1956-138-0x0000000005C60000-0x0000000006204000-memory.dmp

Filesize
5.6MB

Download
memory/1956-136-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4252-140-0x0000000000000000-mapping.dmp

Download
memory/4368-133-0x0000000000000000-mapping.dmp

Download
memory/4776-130-0x0000000000CB0000-0x0000000000D82000-memory.dmp

Filesize
840KB

Download
memory/4776-132-0x0000000005BA0000-0x0000000005C32000-memory.dmp

Filesize
584KB

Download
memory/4776-131-0x0000000005A60000-0x0000000005AFC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads