Overview

overview

10

Static

static

10

PO 7405591...40.exe

windows7_x64

10

PO 7405591...40.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ff49433d67b8d8ffb6c3757b20b3baf4f45399ec3560876ef4f819b0aae6c194
  • Size 554KB
  • Sample220521-b7msbagden
  • SHA256 ff49433d67b8d8ffb6c3757b20b3baf4f45399ec3560876ef4f819b0aae6c194
  • MD5 SHA1 SHA512
Score
10/10
massloggerransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

  • masslogger

Ransom Note
  • ################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 4:41:34 AM MassLogger Started: 5/21/2022 4:41:22 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

    • Target
      PO 7405591, 7756947 ,7756740.exe
    • Size 1.2MB
    • SHA256 f8a4be5923387077b32e65cfea383db1576e5dd068b926a1e9833ff24e48fd64
    • MD5 SHA1 SHA512
    Score
    10/10
    massloggerransomwarespywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks