masslogger | bf3024a0851044837a102a3eb45be38db8b5c8cb85de0cace2242937a038ccfb

General

Target

??????????? ??????????? ??? online franking ???.exe
Size

1.4MB
MD5

5eecf03b05db7688aeaa9e53815f92fd
SHA1

802f170d063616ba6c5b4b7bda7a145873b27378
SHA256

a8a2e34c6f491ba5d0f16899835630257c0124249fd1d0852b27e736b2a98b3d
SHA512

f0bea4f59dc07a44736ad0eaef9b9bc1758dff22f580a30f54b472899fb9c82bf57030ac0838291e24df55505ad03fc1504ef2ead3a02aa1b5d772e917c97677

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5016-130-0x00000000005F0000-0x000000000076A000-memory.dmp	family_masslogger
behavioral2/memory/4140-134-0x0000000000400000-0x00000000004C2000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

___________ ___________ ___ online franking ___.exe

description	pid	process	target process
PID 5016 set thread context of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

___________ ___________ ___ online franking ___.exepowershell.exe

pid	process
5016	___________ ___________ ___ online franking ___.exe
5016	___________ ___________ ___ online franking ___.exe
5016	___________ ___________ ___ online franking ___.exe
4420	powershell.exe
4420	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

___________ ___________ ___ online franking ___.exepowershell.exe

description pid process

Token: SeDebugPrivilege 5016 ___________ ___________ ___ online franking ___.exe
Token: SeDebugPrivilege 4420 powershell.exe

description	pid	process
Token: SeDebugPrivilege	5016	___________ ___________ ___ online franking ___.exe
Token: SeDebugPrivilege	4420	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

___________ ___________ ___ online franking ___.exe___________ ___________ ___ online franking ___.execmd.exe

description	pid	process	target process
PID 5016 wrote to memory of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe
PID 5016 wrote to memory of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe
PID 5016 wrote to memory of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe
PID 5016 wrote to memory of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe
PID 5016 wrote to memory of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe
PID 5016 wrote to memory of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe
PID 5016 wrote to memory of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe
PID 5016 wrote to memory of 4140	5016	___________ ___________ ___ online franking ___.exe	___________ ___________ ___ online franking ___.exe
PID 4140 wrote to memory of 1976	4140	___________ ___________ ___ online franking ___.exe	cmd.exe
PID 4140 wrote to memory of 1976	4140	___________ ___________ ___ online franking ___.exe	cmd.exe
PID 4140 wrote to memory of 1976	4140	___________ ___________ ___ online franking ___.exe	cmd.exe
PID 1976 wrote to memory of 4420	1976	cmd.exe	powershell.exe
PID 1976 wrote to memory of 4420	1976	cmd.exe	powershell.exe
PID 1976 wrote to memory of 4420	1976	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\___________ ___________ ___ online franking ___.exe
"C:\Users\Admin\AppData\Local\Temp\___________ ___________ ___ online franking ___.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\___________ ___________ ___ online franking ___.exe
  "C:\Users\Admin\AppData\Local\Temp\___________ ___________ ___ online franking ___.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\___________ ___________ ___ online franking ___.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\___________ ___________ ___ online franking ___.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\___________ ___________ ___ online franking ___.exe.log

Filesize
1KB

MD5
fc13935f3038bdde6cb484249fbff668

SHA1
a4c32013e6d59bf1eb1a5119456965de191e62b8

SHA256
de064c569a5f4edaf2da91d7bcb82bab06a35190b699cede1da0aa616a23d676

SHA512
5817275af0f8a48eb1e008d39f62fb3582db9a2d21a806e9f9ee36fbfd799fb17e91f0e3686f4b236724fe78f14ae7f40cd3755f0ec0fb6734ce42f996b798f7

Download Submit
memory/1976-137-0x0000000000000000-mapping.dmp

Download
memory/4140-134-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4140-136-0x0000000005710000-0x0000000005776000-memory.dmp

Filesize
408KB

Download
memory/4140-133-0x0000000000000000-mapping.dmp

Download
memory/4140-135-0x0000000005580000-0x000000000561C000-memory.dmp

Filesize
624KB

Download
memory/4420-145-0x0000000007A20000-0x000000000809A000-memory.dmp

Filesize
6.5MB

Download
memory/4420-139-0x0000000000000000-mapping.dmp

Download
memory/4420-140-0x00000000027E0000-0x0000000002816000-memory.dmp

Filesize
216KB

Download
memory/4420-141-0x0000000005350000-0x0000000005978000-memory.dmp

Filesize
6.2MB

Download
memory/4420-142-0x00000000059B0000-0x00000000059D2000-memory.dmp

Filesize
136KB

Download
memory/4420-143-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Filesize
408KB

Download
memory/4420-144-0x00000000061A0000-0x00000000061BE000-memory.dmp

Filesize
120KB

Download
memory/4420-146-0x00000000066B0000-0x00000000066CA000-memory.dmp

Filesize
104KB

Download
memory/4420-147-0x0000000007440000-0x00000000074D6000-memory.dmp

Filesize
600KB

Download
memory/4420-148-0x0000000006780000-0x00000000067A2000-memory.dmp

Filesize
136KB

Download
memory/5016-132-0x00000000058F0000-0x0000000005982000-memory.dmp

Filesize
584KB

Download
memory/5016-131-0x0000000005DC0000-0x0000000006364000-memory.dmp

Filesize
5.6MB

Download
memory/5016-130-0x00000000005F0000-0x000000000076A000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads