masslogger | ea0a4c4e4ab8b6a483c5bdb3a73cd0ac90b3b0657fecf22829d4d91f1088d8ff

General

Target

OUR_NEW_.exe
Size

757KB
MD5

5eecffe3b62b1e5c080028e6c489cc98
SHA1

3fa94eff0cffe3fcad56d7e7b3dbcbac341211b5
SHA256

571ab77f2e5d3069e9b1974cd7548dd28f4cef875b33698b42a846b6057a476e
SHA512

eb79550f367005386cfc94a674a4c735484df3ff35f038401d5f7995bd0a01eb79d81be3c7b1f4c4b4c6a69dde0a5c28a3e81cd038efc843004310cd2d989cb5

Score

10^/10

masslogger ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:27:28 PM MassLogger Started: 5/21/2022 2:26:58 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 32 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4132-135-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-137-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-139-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-141-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-143-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-145-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-147-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-149-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-151-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-153-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-155-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-157-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-159-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-161-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-163-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-165-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-167-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-169-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-171-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-173-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-175-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-177-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-179-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-181-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-183-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-185-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-187-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-189-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-191-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-193-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-195-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4132-197-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OUR_NEW_.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	OUR_NEW_.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

33 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

OUR_NEW_.exe

description pid process target process

PID 4952 set thread context of 4132 4952 OUR_NEW_.exe OUR_NEW_.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

OUR_NEW_.exe

pid process

4132 OUR_NEW_.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

OUR_NEW_.exe

description pid process

Token: SeDebugPrivilege 4132 OUR_NEW_.exe

flow	ioc
33	api.ipify.org

description	pid	process	target process
PID 4952 set thread context of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe

pid	process
4132	OUR_NEW_.exe

description	pid	process
Token: SeDebugPrivilege	4132	OUR_NEW_.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

OUR_NEW_.exe

description	pid	process	target process
PID 4952 wrote to memory of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe
PID 4952 wrote to memory of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe
PID 4952 wrote to memory of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe
PID 4952 wrote to memory of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe
PID 4952 wrote to memory of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe
PID 4952 wrote to memory of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe
PID 4952 wrote to memory of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe
PID 4952 wrote to memory of 4132	4952	OUR_NEW_.exe	OUR_NEW_.exe

C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe
"C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe
"C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4132-161-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-191-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-645-0x00000000072B0000-0x00000000072BA000-memory.dmp

Filesize
40KB

Download
memory/4132-197-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-134-0x0000000000000000-mapping.dmp

Download
memory/4132-135-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-137-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-139-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-141-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-143-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-145-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-147-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-149-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-165-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-153-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-155-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-157-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-159-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-644-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Filesize
408KB

Download
memory/4132-195-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-151-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-167-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-169-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-171-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-173-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-175-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-177-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-179-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-181-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-183-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-185-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-187-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-189-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-163-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4132-193-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4952-131-0x0000000005CE0000-0x0000000006284000-memory.dmp

Filesize
5.6MB

Download
memory/4952-133-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/4952-130-0x0000000000D00000-0x0000000000DC4000-memory.dmp

Filesize
784KB

Download
memory/4952-132-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads