m00nd3v_logger | 1982cd28239c9b7882794b27b48099bc9f6706df2e47d3916dfc4e811a2b08d6

General

Target

scan00001543.exe
Size

398KB
MD5

5678efb48a28b255830a91e260c2504e
SHA1

e030714e67ddeff23860be582553807d15c7f1e2
SHA256

717cc1c1cd1788a45027d549ae018a57f72e8f5f7586be633055c2400440b489
SHA512

c6146c170b937a7daa9e6be50f7df9eb552216222d474965a41730d4ddfbeaa00466bea48318951b1e5c33d6a79b9791d788ab4e4dc8fac51cea32d35cc54477

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/4856-138-0x0000000000400000-0x0000000000444000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4856-138-0x0000000000400000-0x0000000000444000-memory.dmp	MailPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4856-138-0x0000000000400000-0x0000000000444000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

scan00001543.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	scan00001543.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

scan00001543.exe

description pid process target process

PID 2576 set thread context of 4856 2576 scan00001543.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4204 schtasks.exe

description	pid	process	target process
PID 2576 set thread context of 4856	2576	scan00001543.exe	MSBuild.exe

pid	process
4204	schtasks.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

scan00001543.exe

description	pid	process	target process
PID 2576 wrote to memory of 4204	2576	scan00001543.exe	schtasks.exe
PID 2576 wrote to memory of 4204	2576	scan00001543.exe	schtasks.exe
PID 2576 wrote to memory of 4204	2576	scan00001543.exe	schtasks.exe
PID 2576 wrote to memory of 4856	2576	scan00001543.exe	MSBuild.exe
PID 2576 wrote to memory of 4856	2576	scan00001543.exe	MSBuild.exe
PID 2576 wrote to memory of 4856	2576	scan00001543.exe	MSBuild.exe
PID 2576 wrote to memory of 4856	2576	scan00001543.exe	MSBuild.exe
PID 2576 wrote to memory of 4856	2576	scan00001543.exe	MSBuild.exe
PID 2576 wrote to memory of 4856	2576	scan00001543.exe	MSBuild.exe
PID 2576 wrote to memory of 4856	2576	scan00001543.exe	MSBuild.exe
PID 2576 wrote to memory of 4856	2576	scan00001543.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\scan00001543.exe
"C:\Users\Admin\AppData\Local\Temp\scan00001543.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zICDBE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA14.tmp"
2⤵
- Creates scheduled task(s)
PID:4204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
PID:4856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDA14.tmp
Filesize
1KB

MD5
ebe8b76dd79c203fc0b936ecee2091aa

SHA1
5b4fb6ae3b9daab643e9b07217145c25511ae792

SHA256
89371a82241115447c33424b1a13146177181d4a9ad78c2652ca6d13ba7261ca

SHA512
9e7b41eae03e54b8fd5d45f4bf5e872f6841763b6862eb46cff59a42b827c67c922dba71fd9a17854f8d0e6d14a8a44a35b20ee7b798e98fbc4a27e97e350403

Download Submit
memory/2576-130-0x0000000000030000-0x000000000009A000-memory.dmp

Filesize
424KB

Download
memory/2576-131-0x0000000007450000-0x00000000079F4000-memory.dmp

Filesize
5.6MB

Download
memory/2576-132-0x0000000006F40000-0x0000000006FD2000-memory.dmp

Filesize
584KB

Download
memory/2576-133-0x0000000006F10000-0x0000000006F1A000-memory.dmp

Filesize
40KB

Download
memory/2576-134-0x000000000A9B0000-0x000000000AA4C000-memory.dmp

Filesize
624KB

Download
memory/4204-135-0x0000000000000000-mapping.dmp

Download
memory/4856-137-0x0000000000000000-mapping.dmp

Download
memory/4856-138-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4856-139-0x0000000005610000-0x0000000005676000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads