masslogger | bc52fb733abe8c7201c916a18bf92214f50132eab17878203f2df63a44cb7d4c

General

Target

2020080495209.pdf.exe
Size

1.3MB
MD5

62a5098ca9b33099ef35ff4ab0d5b325
SHA1

bbfb15f6526e804150df582140c5697e7befb7e7
SHA256

f5e0fbe83739081ba2bc70e0aae26a0dd33358061b931f96e3ee12eefae90fbf
SHA512

bfe2deb4362178b7b25a61a227284578c49aca50601877b5f47568e1ed8a73a595043a6961f5b606b5e09c46b9c5b25508c43b2068a036c589396382ce8b0041

Score

10^/10

masslogger collection ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\0F48153F20\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v2.0.0.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 10 Pro 64bit Windows Serial Key: W269N-WFGWX-YVC9B-4J6C9-T83GX CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:20:32 AM MassLogger Started: 5/21/2022 3:20:29 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\2020080495209.pdf.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2020080495209.pdf.exe2020080495209.pdf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	2020080495209.pdf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	2020080495209.pdf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs

collection

Email Collection

T1114

Processes:

2020080495209.pdf.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	2020080495209.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	2020080495209.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	2020080495209.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	2020080495209.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

38 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

2020080495209.pdf.exe

description pid process target process

PID 4576 set thread context of 2116 4576 2020080495209.pdf.exe 2020080495209.pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4804 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

2020080495209.pdf.exe

pid process

2116 2020080495209.pdf.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

2020080495209.pdf.exe2020080495209.pdf.exe

pid process

4576 2020080495209.pdf.exe
4576 2020080495209.pdf.exe
4576 2020080495209.pdf.exe
2116 2020080495209.pdf.exe
2116 2020080495209.pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2020080495209.pdf.exe2020080495209.pdf.exe

description pid process

Token: SeDebugPrivilege 4576 2020080495209.pdf.exe
Token: SeDebugPrivilege 2116 2020080495209.pdf.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2020080495209.pdf.exe

pid process

2116 2020080495209.pdf.exe

flow	ioc
38	api.ipify.org

description	pid	process	target process
PID 4576 set thread context of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe

pid	process
4804	schtasks.exe

pid	process
2116	2020080495209.pdf.exe

pid	process
4576	2020080495209.pdf.exe
4576	2020080495209.pdf.exe
4576	2020080495209.pdf.exe
2116	2020080495209.pdf.exe
2116	2020080495209.pdf.exe

description	pid	process
Token: SeDebugPrivilege	4576	2020080495209.pdf.exe
Token: SeDebugPrivilege	2116	2020080495209.pdf.exe

pid	process
2116	2020080495209.pdf.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2020080495209.pdf.exe

description	pid	process	target process
PID 4576 wrote to memory of 4804	4576	2020080495209.pdf.exe	schtasks.exe
PID 4576 wrote to memory of 4804	4576	2020080495209.pdf.exe	schtasks.exe
PID 4576 wrote to memory of 4804	4576	2020080495209.pdf.exe	schtasks.exe
PID 4576 wrote to memory of 2224	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2224	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2224	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe
PID 4576 wrote to memory of 2116	4576	2020080495209.pdf.exe	2020080495209.pdf.exe

outlook_office_path 1 IoCs

Processes:

2020080495209.pdf.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe

outlook_win_path 1 IoCs

Processes:

2020080495209.pdf.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2020080495209.pdf.exe

C:\Users\Admin\AppData\Local\Temp\2020080495209.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\2020080495209.pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pPEzwiHTypPGTU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9EE0.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\2020080495209.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\2020080495209.pdf.exe"
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\2020080495209.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\2020080495209.pdf.exe"
  2⤵
  - Checks computer location settings
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:2116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2020080495209.pdf.exe.log

Filesize
1KB

MD5
17573558c4e714f606f997e5157afaac

SHA1
13e16e9415ceef429aaf124139671ebeca09ed23

SHA256
c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

SHA512
f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9EE0.tmp

Filesize
1KB

MD5
708eda3b412575a0aa1c36e8f610dcb7

SHA1
0b58edfe537ded98814275938a3dd3272bcc0134

SHA256
1b0158582e0a76ba259cfeccb8cd76a8d68fdf93322dd2e1708bdca2429c26ac

SHA512
143e2a98b1f709c889e972b27436269e030865ce892ed29d49c02b58463d38636501075d3dc57f2ee4346d3785f00549bd50a3a9f3c172f57682fd25a04b8bf3

Download Submit
memory/2116-143-0x0000000007F70000-0x0000000007FC0000-memory.dmp

Filesize
320KB

Download
memory/2116-142-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/2116-140-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2116-139-0x0000000000000000-mapping.dmp

Download
memory/2224-138-0x0000000000000000-mapping.dmp

Download
memory/4576-133-0x00000000052D0000-0x0000000005362000-memory.dmp

Filesize
584KB

Download
memory/4576-135-0x0000000005470000-0x00000000054C6000-memory.dmp

Filesize
344KB

Download
memory/4576-134-0x0000000005250000-0x000000000525A000-memory.dmp

Filesize
40KB

Download
memory/4576-130-0x00000000006C0000-0x000000000081A000-memory.dmp

Filesize
1.4MB

Download
memory/4576-132-0x00000000057E0000-0x0000000005D84000-memory.dmp

Filesize
5.6MB

Download
memory/4576-131-0x0000000005190000-0x000000000522C000-memory.dmp

Filesize
624KB

Download
memory/4804-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads