masslogger | 46455dab58abbeca83badbb41504561f481dfeac961f86024c51b1d0767e5559

General

Target

OUR_NEW_.exe
Size

1.3MB
MD5

8f71a7609408e4af8e1bb7b4bd7307a0
SHA1

2208a70548f67964f48a52df366bd70b5532f6b4
SHA256

4035190e2bab1261203e91970cfdc1f3e13387dcf624ed03f05692e480352fe7
SHA512

9c2cd471748fbb8879cb7d059538a997b6c046f0ad6949238e7d29b667541d7afe225d50f0ff89d87821efeca6fa666e17dfedcc16f4f564b4ac1edc533ec050

Score

10^/10

masslogger ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 127.0.0.1 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:10:11 PM MassLogger Started: 5/21/2022 3:09:52 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1056-54-0x0000000001250000-0x000000000139C000-memory.dmp	family_masslogger
behavioral1/memory/1728-62-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-63-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-64-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-65-0x00000000004ABEAE-mapping.dmp	family_masslogger
behavioral1/memory/1728-67-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-69-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-71-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-73-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-75-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-77-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-79-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-81-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-83-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-85-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-87-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-89-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-91-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-93-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-95-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-97-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-99-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-101-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-103-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-105-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-107-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-109-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-111-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-113-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-115-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-117-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-119-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1728-121-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OUR_NEW_.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	OUR_NEW_.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

OUR_NEW_.exe

description pid process target process

PID 1056 set thread context of 1728 1056 OUR_NEW_.exe OUR_NEW_.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

OUR_NEW_.exeOUR_NEW_.exe

pid process

1056 OUR_NEW_.exe
1056 OUR_NEW_.exe
1056 OUR_NEW_.exe
1728 OUR_NEW_.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

OUR_NEW_.exeOUR_NEW_.exe

description pid process

Token: SeDebugPrivilege 1056 OUR_NEW_.exe
Token: SeDebugPrivilege 1728 OUR_NEW_.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 1056 set thread context of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe

pid	process
1056	OUR_NEW_.exe
1056	OUR_NEW_.exe
1056	OUR_NEW_.exe
1728	OUR_NEW_.exe

description	pid	process
Token: SeDebugPrivilege	1056	OUR_NEW_.exe
Token: SeDebugPrivilege	1728	OUR_NEW_.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

OUR_NEW_.exe

description	pid	process	target process
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe
PID 1056 wrote to memory of 1728	1056	OUR_NEW_.exe	OUR_NEW_.exe

C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe
"C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe
"C:\Users\Admin\AppData\Local\Temp\OUR_NEW_.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-54-0x0000000001250000-0x000000000139C000-memory.dmp

Filesize
1.3MB

Download
memory/1056-55-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/1056-56-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1056-57-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/1056-58-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/1728-59-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-60-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-62-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-63-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-64-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-65-0x00000000004ABEAE-mapping.dmp

Download
memory/1728-67-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-69-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-71-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-73-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-75-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-77-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-79-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-81-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-83-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-85-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-87-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-89-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-91-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-93-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-95-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-97-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-99-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-101-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-103-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-105-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-107-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-109-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-111-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-113-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-115-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-117-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-119-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-121-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1728-578-0x0000000000570000-0x00000000005B4000-memory.dmp

Filesize
272KB

Download
memory/1728-580-0x0000000005095000-0x00000000050A6000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads