masslogger | 3b7c9f0dcedcfc7e28204e228da8bfb05111a0621b097f4c57bea36074dfee01

General

Target

????? ???? ???????????..exe
Size

879KB
MD5

0d0cc9c2442100d75fb6e2a7f3a9a3a7
SHA1

303231ebf1f84bfc7bffa5f4ffea7f7864932bc7
SHA256

d9b75b8d542d8278b8748169b3250cdf07604dc91e9d5c5a5686727d9f58afb7
SHA512

d25fca0f3f39d8f4210a5078024e45ad830b58c9ff95c31bc35baf2f8cc7cee59e349ce41381106c27a1534beb567d475c984c28d7ccbe324c090bff54159347

Score

10^/10

masslogger collection evasion ransomware rezer0 spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\3B8E3C2477\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:23:45 AM MassLogger Started: 5/21/2022 3:23:21 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\_____ ____ ___________..exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1008-60-0x0000000008680000-0x0000000008730000-memory.dmp	family_masslogger
behavioral1/memory/988-64-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-66-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-67-0x00000000004AB1BE-mapping.dmp	family_masslogger
behavioral1/memory/988-65-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-69-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-71-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-73-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-75-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-77-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-79-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-81-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-83-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-85-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-87-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-89-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-91-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-93-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-95-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-97-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-99-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-101-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-103-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-105-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-107-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-109-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-111-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-113-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-115-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-117-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-119-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-123-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/988-121-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file
Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112

yara_rule
masslogger_log_file

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1008-57-0x0000000005DB0000-0x0000000005E68000-memory.dmp	rezer0

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

_____ ____ ___________..exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation	_____ ____ ___________..exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs

collection

Email Collection

T1114

Processes:

_____ ____ ___________..exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	_____ ____ ___________..exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	_____ ____ ___________..exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	_____ ____ ___________..exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	_____ ____ ___________..exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	_____ ____ ___________..exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	_____ ____ ___________..exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

_____ ____ ___________..exe

description pid process target process

PID 1008 set thread context of 988 1008 _____ ____ ___________..exe _____ ____ ___________..exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2020 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

_____ ____ ___________..exe

pid process

988 _____ ____ ___________..exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

_____ ____ ___________..exe_____ ____ ___________..exe

pid process

1008 _____ ____ ___________..exe
988 _____ ____ ___________..exe
988 _____ ____ ___________..exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

_____ ____ ___________..exe_____ ____ ___________..exe

description pid process

Token: SeDebugPrivilege 1008 _____ ____ ___________..exe
Token: SeDebugPrivilege 988 _____ ____ ___________..exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

_____ ____ ___________..exe

pid process

988 _____ ____ ___________..exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 1008 set thread context of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe

pid	process
2020	schtasks.exe

pid	process
988	_____ ____ ___________..exe

pid	process
1008	_____ ____ ___________..exe
988	_____ ____ ___________..exe
988	_____ ____ ___________..exe

description	pid	process
Token: SeDebugPrivilege	1008	_____ ____ ___________..exe
Token: SeDebugPrivilege	988	_____ ____ ___________..exe

pid	process
988	_____ ____ ___________..exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

_____ ____ ___________..exe

description	pid	process	target process
PID 1008 wrote to memory of 2020	1008	_____ ____ ___________..exe	schtasks.exe
PID 1008 wrote to memory of 2020	1008	_____ ____ ___________..exe	schtasks.exe
PID 1008 wrote to memory of 2020	1008	_____ ____ ___________..exe	schtasks.exe
PID 1008 wrote to memory of 2020	1008	_____ ____ ___________..exe	schtasks.exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe
PID 1008 wrote to memory of 988	1008	_____ ____ ___________..exe	_____ ____ ___________..exe

outlook_office_path 1 IoCs

Processes:

_____ ____ ___________..exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe

outlook_win_path 1 IoCs

Processes:

_____ ____ ___________..exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_____ ____ ___________..exe

C:\Users\Admin\AppData\Local\Temp\_____ ____ ___________..exe
"C:\Users\Admin\AppData\Local\Temp\_____ ____ ___________..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HbPEyeZwfOCB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8566.tmp"
2⤵
- Creates scheduled task(s)
PID:2020

C:\Users\Admin\AppData\Local\Temp\_____ ____ ___________..exe
"{path}"
2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Hidden Files and Directories

1

T1158

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8566.tmp
Filesize
1KB

MD5
680d273b94ed4e3afd145fe42ae2ff56

SHA1
71d05ae38c5b4516510c46e0b4552946dd85cff7

SHA256
c26e7f7d12f68f5837a715dbedf4e626952c6e1f39e5034ea046e4f9e1ee0883

SHA512
5ee11ddd70b4daadd8ae18d1c1e2b3d5a23aab76e40c7fad645db2aa1f1273a390a1f6ef31ae77d4ddc04ba036c1ad3b987209610a03a24ac8538d87c2348945

Download Submit
memory/988-83-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-62-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-89-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-582-0x0000000000D65000-0x0000000000D76000-memory.dmp

Filesize
68KB

Download
memory/988-580-0x0000000000820000-0x0000000000864000-memory.dmp

Filesize
272KB

Download
memory/988-121-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-61-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-87-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-64-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-66-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-67-0x00000000004AB1BE-mapping.dmp

Download
memory/988-65-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-85-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-71-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-73-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-75-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-77-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-79-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-81-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-123-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-69-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-119-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-117-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-91-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-93-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-95-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-97-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-99-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-101-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-103-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-105-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-107-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-109-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-111-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-113-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/988-115-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1008-57-0x0000000005DB0000-0x0000000005E68000-memory.dmp

Filesize
736KB

Download
memory/1008-56-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/1008-54-0x00000000010C0000-0x00000000011A2000-memory.dmp

Filesize
904KB

Download
memory/1008-60-0x0000000008680000-0x0000000008730000-memory.dmp

Filesize
704KB

Download
memory/1008-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/2020-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads