masslogger | 0e90bd89cf193f319915fcd00b77547acfd56537a820aee951ece4b3018d685f

General

Target

AVISO, Transferencia ICBC.exe
Size

2.1MB
MD5

c051a6a2518f457e2f98a5ae69b5e74b
SHA1

d4025f3a5f9a5cd1486e4b593c740717eb974630
SHA256

bb69c76bdb4fd7d1cba3cce7ccd70341ef077e7651a2d8542841c8e16125dd36
SHA512

83b03a86840664ed266f66740ed26ce06500c96deac3e0ddd906176b64c9c667153abf54eac82e43a1dc5b7886e7d44bff630d012952c77959e261777e01629c

Score

10^/10

masslogger ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F293CD6622\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 7:12:10 AM MassLogger Started: 5/21/2022 7:12:07 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe As Administrator: True

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file
Executes dropped EXE 1 IoCs

Processes:

InstallUtil.exe

pid process

3088 InstallUtil.exe

yara_rule
masslogger_log_file

pid	process
3088	InstallUtil.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

InstallUtil.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	InstallUtil.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

31 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

AVISO, Transferencia ICBC.exe

description pid process target process

PID 4444 set thread context of 3088 4444 AVISO, Transferencia ICBC.exe InstallUtil.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1332 3088 WerFault.exe InstallUtil.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

InstallUtil.exe

pid process

3088 InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

AVISO, Transferencia ICBC.exeInstallUtil.exe

pid process

4444 AVISO, Transferencia ICBC.exe
4444 AVISO, Transferencia ICBC.exe
4444 AVISO, Transferencia ICBC.exe
3088 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AVISO, Transferencia ICBC.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 4444 AVISO, Transferencia ICBC.exe
Token: SeDebugPrivilege 3088 InstallUtil.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

InstallUtil.exe

pid process

3088 InstallUtil.exe

flow	ioc
31	api.ipify.org

description	pid	process	target process
PID 4444 set thread context of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe

pid	pid_target	process	target process
1332	3088	WerFault.exe	InstallUtil.exe

pid	process
3088	InstallUtil.exe

pid	process
4444	AVISO, Transferencia ICBC.exe
4444	AVISO, Transferencia ICBC.exe
4444	AVISO, Transferencia ICBC.exe
3088	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	4444	AVISO, Transferencia ICBC.exe
Token: SeDebugPrivilege	3088	InstallUtil.exe

pid	process
3088	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AVISO, Transferencia ICBC.exe

description	pid	process	target process
PID 4444 wrote to memory of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe
PID 4444 wrote to memory of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe
PID 4444 wrote to memory of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe
PID 4444 wrote to memory of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe
PID 4444 wrote to memory of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe
PID 4444 wrote to memory of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe
PID 4444 wrote to memory of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe
PID 4444 wrote to memory of 3088	4444	AVISO, Transferencia ICBC.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\AVISO, Transferencia ICBC.exe
"C:\Users\Admin\AppData\Local\Temp\AVISO, Transferencia ICBC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 1812
3⤵
- Program crash
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3088 -ip 3088
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
memory/3088-162-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-192-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-644-0x00000000068A0000-0x00000000068AA000-memory.dmp

Filesize
40KB

Download
memory/3088-135-0x0000000000000000-mapping.dmp

Download
memory/3088-136-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-643-0x00000000057E0000-0x0000000005846000-memory.dmp

Filesize
408KB

Download
memory/3088-200-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-142-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-140-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-144-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-146-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-148-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-150-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-152-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-154-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-156-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-158-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-166-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-198-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-196-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-160-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-168-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-170-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-172-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-174-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-176-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-178-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-180-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-182-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-184-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-186-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-188-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-190-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-194-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/3088-164-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/4444-133-0x0000000005F80000-0x0000000005FC4000-memory.dmp

Filesize
272KB

Download
memory/4444-131-0x0000000006000000-0x00000000065A4000-memory.dmp

Filesize
5.6MB

Download
memory/4444-130-0x0000000000E30000-0x0000000001054000-memory.dmp

Filesize
2.1MB

Download
memory/4444-132-0x0000000005B30000-0x0000000005BC2000-memory.dmp

Filesize
584KB

Download
memory/4444-134-0x00000000076C0000-0x00000000076E2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing