masslogger | 843350d85ff1df2146d6a0f4b80fd182480ed7388a621c9f70a6b66a95004d1b

General

Target

097663899 NEW ORDER.exe
Size

806KB
MD5

7fa6a760ba0703205ba51d9bd39d67b3
SHA1

965538e4662b0b2d628c1f3f72f2ec0b570d2424
SHA256

c744751ad79f737ac78fe9c69afac4c7b8940951b2fe67d20175d27e77721371
SHA512

3d906e71f364e4ebd915634094a49ea4223c27bfb76529be9d49b65044610305022492d6e235952cb480f6a3da0477a98c71a450e8a8511803cc4efdc652c00e

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1484-59-0x0000000000400000-0x000000000048E000-memory.dmp	family_masslogger
behavioral1/memory/1484-60-0x0000000000400000-0x000000000048E000-memory.dmp	family_masslogger
behavioral1/memory/1484-62-0x000000000048997E-mapping.dmp	family_masslogger
behavioral1/memory/1484-61-0x0000000000400000-0x000000000048E000-memory.dmp	family_masslogger
behavioral1/memory/1484-64-0x0000000000400000-0x000000000048E000-memory.dmp	family_masslogger
behavioral1/memory/1484-66-0x0000000000400000-0x000000000048E000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

097663899 NEW ORDER.exe

description pid process target process

PID 784 set thread context of 1484 784 097663899 NEW ORDER.exe RegSvcs.exe

description	pid	process	target process
PID 784 set thread context of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

097663899 NEW ORDER.exeRegSvcs.exe

description	pid	process	target process
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 784 wrote to memory of 1484	784	097663899 NEW ORDER.exe	RegSvcs.exe
PID 1484 wrote to memory of 2044	1484	RegSvcs.exe	dw20.exe
PID 1484 wrote to memory of 2044	1484	RegSvcs.exe	dw20.exe
PID 1484 wrote to memory of 2044	1484	RegSvcs.exe	dw20.exe
PID 1484 wrote to memory of 2044	1484	RegSvcs.exe	dw20.exe

memory/784-54-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/784-55-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/1484-56-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1484-57-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1484-59-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1484-60-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1484-62-0x000000000048997E-mapping.dmp

Download
memory/1484-61-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1484-64-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1484-66-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1484-70-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/2044-68-0x0000000000000000-mapping.dmp

Download