masslogger | ca175c94eb00b4846925e068678e41edc91faf50950303699635ee3f0546683b

General

Target

rfq Img docs892712.exe
Size

957KB
MD5

ffff0929aa619672f34a16a852e975c5
SHA1

dcb35d17e4df834d0d1d6666c3f06b082248c745
SHA256

c324d9dd65de8e5ad44795db94a24c3b2b3db5cdd88d5c35de386e039772a364
SHA512

f99331a74a77b9747c115b5677c249380f31470d069742c2c367a4cfe785ca7ad9fc76fbd8b5e4d32d814e619a03b120672c86e076937d078942314b208bdbd4

Score

10^/10

masslogger collection coreentity rezer0 spyware stealer

Malware Config

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1272-56-0x00000000004F0000-0x00000000004F8000-memory.dmp	coreentity

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 32 IoCs

Processes:

resource	yara_rule
behavioral1/memory/852-63-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-64-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-65-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-66-0x00000000004A19AE-mapping.dmp	family_masslogger
behavioral1/memory/852-68-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-70-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-72-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-74-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-76-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-78-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-80-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-82-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-84-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-86-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-88-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-90-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-92-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-94-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-96-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-98-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-100-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-102-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-104-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-106-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-108-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-110-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-112-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-114-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-116-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-118-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-120-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger
behavioral1/memory/852-122-0x0000000000400000-0x00000000004A6000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1272-57-0x00000000053E0000-0x000000000548E000-memory.dmp	rezer0

Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rfq Img docs892712.exe

description pid process target process

PID 1272 set thread context of 852 1272 rfq Img docs892712.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1692 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

MSBuild.exe

pid process

852 MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

852 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 852 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

852 MSBuild.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 1272 set thread context of 852	1272	rfq Img docs892712.exe	MSBuild.exe

pid	process
1692	schtasks.exe

pid	process
852	MSBuild.exe

pid	process
852	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	852	MSBuild.exe

pid	process
852	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rfq Img docs892712.exe

description	pid	process	target process
PID 1272 wrote to memory of 1692	1272	rfq Img docs892712.exe	schtasks.exe
PID 1272 wrote to memory of 1692	1272	rfq Img docs892712.exe	schtasks.exe
PID 1272 wrote to memory of 1692	1272	rfq Img docs892712.exe	schtasks.exe
PID 1272 wrote to memory of 1692	1272	rfq Img docs892712.exe	schtasks.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe
PID 1272 wrote to memory of 852	1272	rfq Img docs892712.exe	MSBuild.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\rfq Img docs892712.exe
"C:\Users\Admin\AppData\Local\Temp\rfq Img docs892712.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\okFpWBEWz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD24.tmp"
2⤵
- Creates scheduled task(s)
PID:1692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFD24.tmp
Filesize
1KB

MD5
f0c366c613ac8bfda0d71393f871a3f5

SHA1
007fefb0852033971f88265a4b38b9517dd32a45

SHA256
158d352b52b06edc454d1f77299a88ac13a46e72f9b1bd252a50c45bd985139b

SHA512
6f06adf0ef7c2d08fb3385cda3554aa32a214e3c8da0da1c5e926b3a68c6faa4679c45dbab03baec4269834251c325b0b5efba61afa05c634f03565ac795037a

Download Submit
memory/852-84-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-114-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-572-0x00000000007C0000-0x0000000000804000-memory.dmp

Filesize
272KB

Download
memory/852-122-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-120-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-60-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-82-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-63-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-64-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-65-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-66-0x00000000004A19AE-mapping.dmp

Download
memory/852-68-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-70-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-72-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-74-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-76-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-78-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-86-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-61-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-118-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-80-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-88-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-90-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-92-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-94-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-96-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-98-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-100-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-102-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-104-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-106-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-108-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-110-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-112-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/852-116-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1272-54-0x0000000001180000-0x0000000001276000-memory.dmp

Filesize
984KB

Download
memory/1272-56-0x00000000004F0000-0x00000000004F8000-memory.dmp

Filesize
32KB

Download
memory/1272-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1272-57-0x00000000053E0000-0x000000000548E000-memory.dmp

Filesize
696KB

Download
memory/1692-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads