masslogger | 10a4ba420a16ca28bd4a7b50d7f947d4705bba87031009a45e8ace94e7dee855

Analysis

max time kernel
112s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/05/2022, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RK__PO_N.exe
Size

981KB
MD5

96de546b32289587f7db830e1e385a26
SHA1

60f2925dc7ebdb8aa4c844edcaa3b0b5c6b4954b
SHA256

00068dc51db13086db2a9fc776a55a946c699f1a225ee6595ae6b91ea469356c
SHA512

f26fe0d399a4b428a80a828c29e63145c7eb406200829fa473ae40e77c055f45071d4cacb02c8a59c87969ecb0dc3f7a7e97387bc0ecf34d080ede36b18951fd

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 32 IoCs

resource	yara_rule
behavioral4/memory/1764-138-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-141-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-143-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-145-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-147-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-149-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-151-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-153-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-155-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-157-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-159-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-161-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-163-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-165-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-167-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-169-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-171-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-173-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-175-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-177-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-179-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-181-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-183-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-185-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-187-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-189-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-191-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-193-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-195-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-197-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-199-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral4/memory/1764-201-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	RK__PO_N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 1764	4732	RK__PO_N.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4732	RK__PO_N.exe
4732	RK__PO_N.exe
4732	RK__PO_N.exe
4904	powershell.exe
4904	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	RK__PO_N.exe
Token: SeDebugPrivilege	1764	RK__PO_N.exe
Token: SeDebugPrivilege	4904	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 3476	4732	RK__PO_N.exe	90
PID 4732 wrote to memory of 3476	4732	RK__PO_N.exe	90
PID 4732 wrote to memory of 3476	4732	RK__PO_N.exe	90
PID 4732 wrote to memory of 1764	4732	RK__PO_N.exe	92
PID 4732 wrote to memory of 1764	4732	RK__PO_N.exe	92
PID 4732 wrote to memory of 1764	4732	RK__PO_N.exe	92
PID 4732 wrote to memory of 1764	4732	RK__PO_N.exe	92
PID 4732 wrote to memory of 1764	4732	RK__PO_N.exe	92
PID 4732 wrote to memory of 1764	4732	RK__PO_N.exe	92
PID 4732 wrote to memory of 1764	4732	RK__PO_N.exe	92
PID 4732 wrote to memory of 1764	4732	RK__PO_N.exe	92
PID 1764 wrote to memory of 3640	1764	RK__PO_N.exe	93
PID 1764 wrote to memory of 3640	1764	RK__PO_N.exe	93
PID 1764 wrote to memory of 3640	1764	RK__PO_N.exe	93
PID 3640 wrote to memory of 4904	3640	cmd.exe	95
PID 3640 wrote to memory of 4904	3640	cmd.exe	95
PID 3640 wrote to memory of 4904	3640	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\RK__PO_N.exe
"C:\Users\Admin\AppData\Local\Temp\RK__PO_N.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hffwylP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBFA6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3476
- C:\Users\Admin\AppData\Local\Temp\RK__PO_N.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RK__PO_N.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RK__PO_N.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RK__PO_N.exe.log

Filesize
1KB

MD5
400f1cc1a0a0ce1cdabda365ab3368ce

SHA1
1ecf683f14271d84f3b6063493dce00ff5f42075

SHA256
c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765

SHA512
14c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBFA6.tmp

Filesize
1KB

MD5
541e13162b02b801210b581259326985

SHA1
40a7b5e6a0a7cade43dd40f81143ae68223ebc9f

SHA256
a4fbb92255c1350690efdcdb768e19442eecb00330571d4fdaf530c45c19d604

SHA512
4f839d09db90b8771ff9d2db77781a283ddeeb40a6e543518c4c302787462b87d4b2193543ce6545ff1f6638468a8de7d737edf5fdaa55e4dd95c0fea24177b8

Download Submit
memory/1764-183-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-169-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-656-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Filesize
408KB

Download
memory/1764-141-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-143-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-145-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-147-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-149-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-151-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-153-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-155-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-157-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-159-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-161-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-163-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-165-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-167-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-187-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-171-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-173-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-175-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-177-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-179-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-181-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-138-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-185-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-189-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-191-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-193-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-195-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-197-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-199-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-201-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4732-130-0x0000000000080000-0x000000000017E000-memory.dmp

Filesize
1016KB

Download
memory/4732-131-0x000000000A830000-0x000000000ADD4000-memory.dmp

Filesize
5.6MB

Download
memory/4732-132-0x000000000A420000-0x000000000A4B2000-memory.dmp

Filesize
584KB

Download
memory/4732-133-0x000000000A380000-0x000000000A38A000-memory.dmp

Filesize
40KB

Download
memory/4732-134-0x000000000DBC0000-0x000000000DC5C000-memory.dmp

Filesize
624KB

Download
memory/4904-659-0x0000000004B70000-0x0000000004BA6000-memory.dmp

Filesize
216KB

Download
memory/4904-660-0x00000000051E0000-0x0000000005808000-memory.dmp

Filesize
6.2MB

Download
memory/4904-661-0x00000000059A0000-0x00000000059C2000-memory.dmp

Filesize
136KB

Download
memory/4904-662-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/4904-663-0x0000000006130000-0x000000000614E000-memory.dmp

Filesize
120KB

Download
memory/4904-664-0x0000000007990000-0x000000000800A000-memory.dmp

Filesize
6.5MB

Download
memory/4904-665-0x0000000006630000-0x000000000664A000-memory.dmp

Filesize
104KB

Download
memory/4904-666-0x00000000073B0000-0x0000000007446000-memory.dmp

Filesize
600KB

Download
memory/4904-667-0x0000000006700000-0x0000000006722000-memory.dmp

Filesize
136KB

Download