m00nd3v_logger | 1982cd28239c9b7882794b27b48099bc9f6706df2e47d3916dfc4e811a2b08d6

General

Target

scan00001543.exe
Size

398KB
MD5

5678efb48a28b255830a91e260c2504e
SHA1

e030714e67ddeff23860be582553807d15c7f1e2
SHA256

717cc1c1cd1788a45027d549ae018a57f72e8f5f7586be633055c2400440b489
SHA512

c6146c170b937a7daa9e6be50f7df9eb552216222d474965a41730d4ddfbeaa00466bea48318951b1e5c33d6a79b9791d788ab4e4dc8fac51cea32d35cc54477

Score

10^/10

m00nd3v_logger collection coreentity infostealer rezer0 spyware stealer

Malware Config

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/860-56-0x0000000000930000-0x0000000000938000-memory.dmp	coreentity

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 6 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/896-63-0x0000000000400000-0x0000000000444000-memory.dmp	m00nd3v_logger
behavioral1/memory/896-64-0x0000000000400000-0x0000000000444000-memory.dmp	m00nd3v_logger
behavioral1/memory/896-65-0x0000000000400000-0x0000000000444000-memory.dmp	m00nd3v_logger
behavioral1/memory/896-66-0x000000000043F95E-mapping.dmp	m00nd3v_logger
behavioral1/memory/896-68-0x0000000000400000-0x0000000000444000-memory.dmp	m00nd3v_logger
behavioral1/memory/896-70-0x0000000000400000-0x0000000000444000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 10 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/896-63-0x0000000000400000-0x0000000000444000-memory.dmp	MailPassView
behavioral1/memory/896-64-0x0000000000400000-0x0000000000444000-memory.dmp	MailPassView
behavioral1/memory/896-65-0x0000000000400000-0x0000000000444000-memory.dmp	MailPassView
behavioral1/memory/896-66-0x000000000043F95E-mapping.dmp	MailPassView
behavioral1/memory/896-68-0x0000000000400000-0x0000000000444000-memory.dmp	MailPassView
behavioral1/memory/896-70-0x0000000000400000-0x0000000000444000-memory.dmp	MailPassView
behavioral1/memory/868-80-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/868-81-0x000000000041211A-mapping.dmp	MailPassView
behavioral1/memory/868-84-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/868-85-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

Nirsoft 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/896-63-0x0000000000400000-0x0000000000444000-memory.dmp	Nirsoft
behavioral1/memory/896-64-0x0000000000400000-0x0000000000444000-memory.dmp	Nirsoft
behavioral1/memory/896-65-0x0000000000400000-0x0000000000444000-memory.dmp	Nirsoft
behavioral1/memory/896-66-0x000000000043F95E-mapping.dmp	Nirsoft
behavioral1/memory/896-68-0x0000000000400000-0x0000000000444000-memory.dmp	Nirsoft
behavioral1/memory/896-70-0x0000000000400000-0x0000000000444000-memory.dmp	Nirsoft
behavioral1/memory/868-80-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/868-81-0x000000000041211A-mapping.dmp	Nirsoft
behavioral1/memory/868-84-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/868-85-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/860-57-0x0000000004790000-0x00000000047DC000-memory.dmp	rezer0

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

scan00001543.exeMSBuild.exe

description	pid	process	target process
PID 860 set thread context of 896	860	scan00001543.exe	MSBuild.exe
PID 896 set thread context of 868	896	MSBuild.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1284 schtasks.exe

pid	process
1284	schtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

scan00001543.exeMSBuild.exe

description	pid	process	target process
PID 860 wrote to memory of 1284	860	scan00001543.exe	schtasks.exe
PID 860 wrote to memory of 1284	860	scan00001543.exe	schtasks.exe
PID 860 wrote to memory of 1284	860	scan00001543.exe	schtasks.exe
PID 860 wrote to memory of 1284	860	scan00001543.exe	schtasks.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 860 wrote to memory of 896	860	scan00001543.exe	MSBuild.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe
PID 896 wrote to memory of 868	896	MSBuild.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\scan00001543.exe
"C:\Users\Admin\AppData\Local\Temp\scan00001543.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zICDBE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4857.tmp"
2⤵
- Creates scheduled task(s)
PID:1284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp5EE3.tmp"
3⤵
- Accesses Microsoft Outlook accounts
PID:868

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4857.tmp
Filesize
1KB

MD5
399697dfb7e41639173e5c3e5169f46e

SHA1
563b498a80bb781a61eaaeed8800317bb0657c0d

SHA256
2ec634dc5a86e78f1a0c491ad2ded8cce148ffa3b669e6c708f3849bde93fd32

SHA512
31c874de762991b03b1abf30b07d2bd7601c0722991b92bab7dd47b532cc876ee89108d3487264d81b69e6367eaeb5f20c849a0ca68edea9f4eeaa02d04e65e4

Download Submit
memory/860-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/860-56-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/860-57-0x0000000004790000-0x00000000047DC000-memory.dmp

Filesize
304KB

Download
memory/860-54-0x0000000000980000-0x00000000009EA000-memory.dmp

Filesize
424KB

Download
memory/868-73-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/868-75-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/868-85-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/868-84-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/868-81-0x000000000041211A-mapping.dmp

Download
memory/868-80-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/868-78-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/868-77-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/868-72-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/896-70-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/896-68-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/896-66-0x000000000043F95E-mapping.dmp

Download
memory/896-60-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/896-65-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/896-64-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/896-63-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/896-61-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1284-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads