masslogger | 6e95aadb90487e5aeb5082adef9daa2befdf49dfb0eb021422c66501d8018182

General

Target

RE QUATATION 3456765.exe
Size

844KB
MD5

94b5d1e0347081440bf95c6e1a5a26e8
SHA1

5e945849f712f7a565a1c75d1d2e58eeff39775d
SHA256

846f306ccd5e9d610aa3bb92817e08e123cc6be01c4771cdcad518130770c9dd
SHA512

04d85dd2a93b3c9894d2c7e861910e507fdab0147556854eaa74f329d40e448d525e2eec9d106204a8dec8d951457a469a38a2a4b61c9cc7a133d46639bafdef

Score

10^/10

masslogger evasion spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4928-136-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RE QUATATION 3456765.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RE QUATATION 3456765.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RE QUATATION 3456765.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

RE QUATATION 3456765.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RE QUATATION 3456765.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	RE QUATATION 3456765.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

RE QUATATION 3456765.exe

description pid process target process

PID 1320 set thread context of 4928 1320 RE QUATATION 3456765.exe RE QUATATION 3456765.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4632 powershell.exe
4632 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4632 powershell.exe

description	pid	process	target process
PID 1320 set thread context of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe

pid	process
4632	powershell.exe
4632	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4632	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

RE QUATATION 3456765.exeRE QUATATION 3456765.execmd.exe

description	pid	process	target process
PID 1320 wrote to memory of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe
PID 1320 wrote to memory of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe
PID 1320 wrote to memory of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe
PID 1320 wrote to memory of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe
PID 1320 wrote to memory of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe
PID 1320 wrote to memory of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe
PID 1320 wrote to memory of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe
PID 1320 wrote to memory of 4928	1320	RE QUATATION 3456765.exe	RE QUATATION 3456765.exe
PID 4928 wrote to memory of 2040	4928	RE QUATATION 3456765.exe	cmd.exe
PID 4928 wrote to memory of 2040	4928	RE QUATATION 3456765.exe	cmd.exe
PID 4928 wrote to memory of 2040	4928	RE QUATATION 3456765.exe	cmd.exe
PID 2040 wrote to memory of 4632	2040	cmd.exe	powershell.exe
PID 2040 wrote to memory of 4632	2040	cmd.exe	powershell.exe
PID 2040 wrote to memory of 4632	2040	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe
"C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RE QUATATION 3456765.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RE QUATATION 3456765.exe.log

Filesize
599B

MD5
b98b34a0939a52075c19959d5564e798

SHA1
cbaaa2e88b48648b9875afac8f33b4c30703378e

SHA256
937899941aa7d74e757dae8ccf5b05a0e2d9452b735cfb91d285e5415dd5e852

SHA512
7fb6692f780abbbc099bde1b42721d71acce0c0b8cea0cd0b5c1f07c4152fb1a1a1d99ed452ef2c01523d0653f177e66a7232712e5a70cc1468ddc9ad556a3d3

Download Submit
memory/1320-131-0x00000000055F0000-0x000000000568C000-memory.dmp

Filesize
624KB

Download
memory/1320-132-0x00000000057A0000-0x0000000005832000-memory.dmp

Filesize
584KB

Download
memory/1320-133-0x00000000077C0000-0x0000000007D64000-memory.dmp

Filesize
5.6MB

Download
memory/1320-134-0x00000000016E0000-0x0000000001746000-memory.dmp

Filesize
408KB

Download
memory/1320-130-0x0000000000BF0000-0x0000000000CCA000-memory.dmp

Filesize
872KB

Download
memory/2040-138-0x0000000000000000-mapping.dmp

Download
memory/4632-139-0x0000000000000000-mapping.dmp

Download
memory/4632-140-0x0000000004920000-0x0000000004956000-memory.dmp

Filesize
216KB

Download
memory/4632-141-0x00000000050F0000-0x0000000005718000-memory.dmp

Filesize
6.2MB

Download
memory/4632-142-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

Filesize
136KB

Download
memory/4632-143-0x0000000005070000-0x00000000050D6000-memory.dmp

Filesize
408KB

Download
memory/4632-144-0x0000000005E90000-0x0000000005EAE000-memory.dmp

Filesize
120KB

Download
memory/4632-145-0x0000000007500000-0x0000000007B7A000-memory.dmp

Filesize
6.5MB

Download
memory/4632-146-0x0000000006360000-0x000000000637A000-memory.dmp

Filesize
104KB

Download
memory/4632-147-0x0000000007120000-0x00000000071B6000-memory.dmp

Filesize
600KB

Download
memory/4632-148-0x0000000006470000-0x0000000006492000-memory.dmp

Filesize
136KB

Download
memory/4928-136-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4928-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads