masslogger | 5a7b4a2c621603832c1e73ad6d7ad022c260daaca1ea193a5e0ecca3bc5609d3

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/05/2022, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BL_0003.exe
Size 813KB
Sample220521-asdenadfen
SHA256 eb3d6a6bfec90855240b6e239a10d283ecf13b118e9b769e2f4100b3eec76a12
MD5 e62ddd8facfe9707b2f56fd60bb09266
SHA1 7c3e04a6eb2252a38b50b237ba201114bdfaf346
SHA512 50022648bc29f6cdcb20a6e640848908d35785e463056efbfc06e2666b1015589e156b4a82dd25c33252d566d638f2ab0f0e059ce36f58e2f84e02d0b382224e
MD5 SHA1 SHA512

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1956-136-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	BL_0003.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 1956	4776	BL_0003.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
4776	BL_0003.exe
492	powershell.exe
492	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	BL_0003.exe
Token: SeDebugPrivilege	492	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4368	4776	BL_0003.exe	87
PID 4776 wrote to memory of 4368	4776	BL_0003.exe	87
PID 4776 wrote to memory of 4368	4776	BL_0003.exe	87
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	89
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	89
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	89
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	89
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	89
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	89
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	89
PID 4776 wrote to memory of 1956	4776	BL_0003.exe	89
PID 1956 wrote to memory of 4252	1956	BL_0003.exe	90
PID 1956 wrote to memory of 4252	1956	BL_0003.exe	90
PID 1956 wrote to memory of 4252	1956	BL_0003.exe	90
PID 4252 wrote to memory of 492	4252	cmd.exe	92
PID 4252 wrote to memory of 492	4252	cmd.exe	92
PID 4252 wrote to memory of 492	4252	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\BL_0003.exe
"C:\Users\Admin\AppData\Local\Temp\BL_0003.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fauItV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AE6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\BL_0003.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\BL_0003.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\BL_0003.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BL_0003.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BL_0003.exe.log
Size 412B
SHA256 0a534a3d0fa82e6a427164c5f6e702cac7e4afc9967af9bc5ddba4f84ab33276
MD5 ad1c7f6525cfeb54c0487efd38b0e26c
SHA1 ed3da94723ac7e3828a9e93d68418bb810592f3b
SHA512 48d625e6be5391d91d95c2850226fe39bb2411cb72139797699cfe126e6b066182e83950a8ea67e63b64a66b0d45f58d8bc97cab0363d55c2fd88c0d1d28009c
MD5 SHA1 SHA512

Submit Download

tmp3AE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3AE6.tmp
Size 1KB
SHA256 ce2dea444830cd4629026df83cbd8f1d5cce96b8cdef1324c574bb06d232cfda
MD5 7a14eede73b08d78ab2d87985ddfd95b
SHA1 d4e54016e70c1d9adf3264b790a124add1d1bd73
SHA512 c2c554d47f70f982cba9c6753be7a7d371c5de4e75e9ebb130b31b12808800dd9b9a33511652b5ddaf4b67e007b781adfe3860ecc41d1d03985e50bbf34db20b
MD5 SHA1 SHA512

Submit Download

memory/492-142-0x0000000004590000-0x00000000045C6000-memory.dmp

Download

memory/492-150-0x0000000006100000-0x0000000006122000-memory.dmp

Download

memory/492-149-0x0000000006DA0000-0x0000000006E36000-memory.dmp

Download

memory/492-148-0x0000000006020000-0x000000000603A000-memory.dmp

Download

memory/492-147-0x0000000007180000-0x00000000077FA000-memory.dmp

Download

memory/492-146-0x0000000005B20000-0x0000000005B3E000-memory.dmp

Download

memory/492-145-0x0000000005420000-0x0000000005486000-memory.dmp

Download

memory/492-144-0x0000000005380000-0x00000000053A2000-memory.dmp

Download

memory/492-143-0x0000000004C60000-0x0000000005288000-memory.dmp

Download

memory/1956-139-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/1956-138-0x0000000005C60000-0x0000000006204000-memory.dmp

Download

memory/1956-136-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4776-130-0x0000000000CB0000-0x0000000000D82000-memory.dmp

Download

memory/4776-132-0x0000000005BA0000-0x0000000005C32000-memory.dmp

Download

memory/4776-131-0x0000000005A60000-0x0000000005AFC000-memory.dmp

Download