masslogger | 2978b788d747c1dfe75e273d6fdff0dab0ac85e589a8f953786fa23d899276c5

General

Target

Circulator 27643.exe
Size

953KB
MD5

048b39faaf884a5eae0a72e2325a6fb0
SHA1

fcade786c16cd0af8b5699e57b54a30a7ce08f09
SHA256

7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1
SHA512

b360b817f6df4ac7303df3c8ee4657805780b9660823bbc1cd78ce24df8e6af48d914e3aa06215064f217d903311f6ab52e9cd80e1b2fb83d02ef0439d12d464

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 32 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3880-137-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-139-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-141-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-143-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-145-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-147-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-149-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-151-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-153-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-155-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-157-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-159-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-161-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-163-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-165-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-167-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-169-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-171-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-173-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-175-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-177-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-179-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-181-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-183-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-185-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-187-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-189-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-191-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-193-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-195-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-197-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger
behavioral2/memory/3880-199-0x0000000000400000-0x00000000004B2000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Circulator 27643.exeCirculator 27643.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Circulator 27643.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Circulator 27643.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

47 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Circulator 27643.exe

description pid process target process

PID 3300 set thread context of 3880 3300 Circulator 27643.exe Circulator 27643.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2252 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Circulator 27643.exe

pid process

3300 Circulator 27643.exe
3300 Circulator 27643.exe
3300 Circulator 27643.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Circulator 27643.exeCirculator 27643.exe

description pid process

Token: SeDebugPrivilege 3300 Circulator 27643.exe
Token: SeDebugPrivilege 3880 Circulator 27643.exe

flow	ioc
47	api.ipify.org

description	pid	process	target process
PID 3300 set thread context of 3880	3300	Circulator 27643.exe	Circulator 27643.exe

pid	process
2252	schtasks.exe

pid	process
3300	Circulator 27643.exe
3300	Circulator 27643.exe
3300	Circulator 27643.exe

description	pid	process
Token: SeDebugPrivilege	3300	Circulator 27643.exe
Token: SeDebugPrivilege	3880	Circulator 27643.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Circulator 27643.exe

description	pid	process	target process
PID 3300 wrote to memory of 2252	3300	Circulator 27643.exe	schtasks.exe
PID 3300 wrote to memory of 2252	3300	Circulator 27643.exe	schtasks.exe
PID 3300 wrote to memory of 2252	3300	Circulator 27643.exe	schtasks.exe
PID 3300 wrote to memory of 3880	3300	Circulator 27643.exe	Circulator 27643.exe
PID 3300 wrote to memory of 3880	3300	Circulator 27643.exe	Circulator 27643.exe
PID 3300 wrote to memory of 3880	3300	Circulator 27643.exe	Circulator 27643.exe
PID 3300 wrote to memory of 3880	3300	Circulator 27643.exe	Circulator 27643.exe
PID 3300 wrote to memory of 3880	3300	Circulator 27643.exe	Circulator 27643.exe
PID 3300 wrote to memory of 3880	3300	Circulator 27643.exe	Circulator 27643.exe
PID 3300 wrote to memory of 3880	3300	Circulator 27643.exe	Circulator 27643.exe
PID 3300 wrote to memory of 3880	3300	Circulator 27643.exe	Circulator 27643.exe

C:\Users\Admin\AppData\Local\Temp\Circulator 27643.exe
"C:\Users\Admin\AppData\Local\Temp\Circulator 27643.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GBzuDXzfD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB169.tmp"
2⤵
- Creates scheduled task(s)
PID:2252

C:\Users\Admin\AppData\Local\Temp\Circulator 27643.exe
"{path}"
2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB169.tmp
Filesize
1KB

MD5
d06d35538206055a33c211c41fb35f23

SHA1
ff1e9b447738883046849fdba0102cfb57691f81

SHA256
cbe578748da7a1822cdec922dbb70e7fe4a128a8fae27b22bcfe0862fb7cf773

SHA512
7bbd1e9b38ed2c015e518fb558eb31a0ac4612e04f6fccc321dc6fc8bb8cccd5a80ebcdee0040a96478d2d8e4ffa8811da8c7036fb8a9782f6bf56e8555f0062

Download Submit
memory/2252-134-0x0000000000000000-mapping.dmp

Download
memory/3300-130-0x0000000000610000-0x0000000000704000-memory.dmp

Filesize
976KB

Download
memory/3300-131-0x0000000008060000-0x0000000008604000-memory.dmp

Filesize
5.6MB

Download
memory/3300-132-0x0000000007B90000-0x0000000007C22000-memory.dmp

Filesize
584KB

Download
memory/3300-133-0x0000000007CD0000-0x0000000007D6C000-memory.dmp

Filesize
624KB

Download
memory/3880-163-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-169-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-139-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-141-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-143-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-145-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-147-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-149-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-151-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-153-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-155-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-157-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-159-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-161-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-136-0x0000000000000000-mapping.dmp

Download
memory/3880-165-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-167-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-171-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-173-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-175-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-177-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-179-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-181-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-183-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-185-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-187-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-189-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-191-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-193-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-195-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-197-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-199-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3880-652-0x0000000005C80000-0x0000000005CE6000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads