masslogger | 2234b93f14f3643cce17c1562c97120e89e2d87e329809a05c033e6fd5b0322c

General

Target

PI1009372PDF.exe
Size

892KB
MD5

029bc6a7b0e7987195c6b17fa6887b1a
SHA1

fe64df31d6a55dad031e6d4c73173df61d56590c
SHA256

1b59de7a97df74d5e59c0f02697e9ae4e9391a01998de6baf4c937bdf2f678f5
SHA512

7a42d6ee3334a78abfe98bf662f6b5cf732f408544ae8dc1e006f295434171e1b1b682f8cb93718113cce9e9e316049ddbc7b291651416f7b161ede547f4feca

Score

10^/10

masslogger collection ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

<|| v2.1.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 11:34:31 AM MassLogger Started: 5/21/2022 11:34:20 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\PI1009372PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PI1009372PDF.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	PI1009372PDF.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

Processes:

PI1009372PDF.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	PI1009372PDF.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

PI1009372PDF.exe

description pid process target process

PID 852 set thread context of 2028 852 PI1009372PDF.exe PI1009372PDF.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1756 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

PI1009372PDF.exe

pid process

2028 PI1009372PDF.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PI1009372PDF.exePI1009372PDF.exe

pid process

852 PI1009372PDF.exe
852 PI1009372PDF.exe
2028 PI1009372PDF.exe
2028 PI1009372PDF.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PI1009372PDF.exePI1009372PDF.exe

description pid process

Token: SeDebugPrivilege 852 PI1009372PDF.exe
Token: SeDebugPrivilege 2028 PI1009372PDF.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PI1009372PDF.exe

pid process

2028 PI1009372PDF.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 852 set thread context of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe

pid	process
1756	schtasks.exe

pid	process
2028	PI1009372PDF.exe

pid	process
852	PI1009372PDF.exe
852	PI1009372PDF.exe
2028	PI1009372PDF.exe
2028	PI1009372PDF.exe

description	pid	process
Token: SeDebugPrivilege	852	PI1009372PDF.exe
Token: SeDebugPrivilege	2028	PI1009372PDF.exe

pid	process
2028	PI1009372PDF.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

PI1009372PDF.exe

description	pid	process	target process
PID 852 wrote to memory of 1756	852	PI1009372PDF.exe	schtasks.exe
PID 852 wrote to memory of 1756	852	PI1009372PDF.exe	schtasks.exe
PID 852 wrote to memory of 1756	852	PI1009372PDF.exe	schtasks.exe
PID 852 wrote to memory of 1756	852	PI1009372PDF.exe	schtasks.exe
PID 852 wrote to memory of 1712	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 1712	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 1712	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 1712	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe
PID 852 wrote to memory of 2028	852	PI1009372PDF.exe	PI1009372PDF.exe

outlook_office_path 1 IoCs

Processes:

PI1009372PDF.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe

outlook_win_path 1 IoCs

Processes:

PI1009372PDF.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PI1009372PDF.exe

C:\Users\Admin\AppData\Local\Temp\PI1009372PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PI1009372PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cmiWvkSiJBmR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6807.tmp"
2⤵
- Creates scheduled task(s)
PID:1756

C:\Users\Admin\AppData\Local\Temp\PI1009372PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PI1009372PDF.exe"
2⤵
PID:1712

C:\Users\Admin\AppData\Local\Temp\PI1009372PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PI1009372PDF.exe"
2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6807.tmp
Filesize
1KB

MD5
c80556c115cb77fcad1bf2eeadaaa5da

SHA1
0ff8f0e9d00b733cd4695a35dc30204ba803e167

SHA256
f9bfd081b0e2e5761f1047c474be6acbffa2565569cbf9fac76995b16ef74c24

SHA512
ca7f2adcb6af611afa720f7a6e579c4760918f9d9093a9eeca2de1f3d26a24c32b5c85e9f21c5f1cb0b65f7c0cb72f0023ccf2d76236178e61ba0b5cbe5f89e1

Download Submit
memory/852-54-0x0000000000080000-0x0000000000166000-memory.dmp

Filesize
920KB

Download
memory/852-55-0x0000000076781000-0x0000000076783000-memory.dmp

Filesize
8KB

Download
memory/852-56-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/852-57-0x0000000005080000-0x0000000005134000-memory.dmp

Filesize
720KB

Download
memory/852-58-0x00000000054A0000-0x000000000553A000-memory.dmp

Filesize
616KB

Download
memory/1756-59-0x0000000000000000-mapping.dmp

Download
memory/2028-62-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2028-61-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2028-64-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2028-65-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2028-67-0x0000000000493F4E-mapping.dmp

Download
memory/2028-66-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2028-69-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2028-71-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2028-72-0x00000000008B0000-0x00000000008F4000-memory.dmp

Filesize
272KB

Download
memory/2028-74-0x0000000002155000-0x0000000002166000-memory.dmp

Filesize
68KB

Download
memory/2028-75-0x00000000021D0000-0x00000000021E4000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads