masslogger | 563c39350c4156354c98d94606e264583ab03712afa53f579859a6b5c45c7230

General

Target

Order 3278526429.exe
Size

838KB
MD5

01ff671b42bdd3445280155368508a36
SHA1

3ea0d6fed3ca6b576561c451bc412e9b7a7edeef
SHA256

e0cb934757cefba44fd4713fc5b5526eb461c0a55c27cb9fd31fca7690e62bc6
SHA512

d9806017b2020e2edda538a7165c2ca330201810dc06e4a432fbf6320355f5ff01693d7ceb620cced3ca8e8e723532b6b9f140f46288017d50e653b16ab5aa78

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1960-59-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral1/memory/1960-60-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral1/memory/1960-62-0x00000000004A304E-mapping.dmp	family_masslogger
behavioral1/memory/1960-61-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral1/memory/1960-64-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral1/memory/1960-66-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

Order 3278526429.exe

description pid process target process

PID 1008 set thread context of 1960 1008 Order 3278526429.exe Order 3278526429.exe

description	pid	process	target process
PID 1008 set thread context of 1960	1008	Order 3278526429.exe	Order 3278526429.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Order 3278526429.exeOrder 3278526429.exe

description	pid	process	target process
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1008 wrote to memory of 1960	1008	Order 3278526429.exe	Order 3278526429.exe
PID 1960 wrote to memory of 1692	1960	Order 3278526429.exe	dw20.exe
PID 1960 wrote to memory of 1692	1960	Order 3278526429.exe	dw20.exe
PID 1960 wrote to memory of 1692	1960	Order 3278526429.exe	dw20.exe
PID 1960 wrote to memory of 1692	1960	Order 3278526429.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\Order 3278526429.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 376
3⤵
PID:1692

memory/1008-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1008-55-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-68-0x0000000000000000-mapping.dmp

Download
memory/1960-56-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-57-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-59-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-60-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-62-0x00000000004A304E-mapping.dmp

Download
memory/1960-61-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-64-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-66-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1960-70-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download