Behavioral Report

Analysis

max time kernel
100s
max time network
104s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAGO_ADJ.exe
Size

1MB
MD5

b69ef4759dddf4f965bf84d654a555ff
SHA1

f894b62e29c20cdd562f02001c5ce30ca5609bb9
SHA256

7ecde113e9bcf315e61368cce51deda2e51321684d9d8e943a31ab1d457988f7
SHA512

529766ef4faa26b9c5e8a2bffd390c64d038724a7492caf5790550062c195ba5d6f2c2d97ad0e6fc5e2a03bf4fc3af6b41c0c4a3a7db9b0fa2e33884f38827cb

Score

10^/10

masslogger agilenet collection ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:35:02 PM MassLogger Started: 5/21/2022 12:34:51 PM Interval: 6 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe As Administrator: True

Extracted

Credentials

Protocol: ftp
Host:
ftp.sisbg.net
Port:
21
Username:
ntums@sisbg.net
Password:
alibaba.com

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 58 IoCs

Processes:

resource	yara_rule
behavioral1/memory/560-54-0x00000000003F0000-0x0000000000532000-memory.dmp	family_masslogger
behavioral1/memory/1736-62-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-63-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-65-0x00000000004A20FE-mapping.dmp	family_masslogger
behavioral1/memory/1736-67-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-66-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-71-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-74-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-75-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-76-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-77-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-78-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-79-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-80-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-81-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-82-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-84-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-85-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-87-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-88-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-89-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-90-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-91-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-92-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-93-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-94-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-96-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-97-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-98-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-99-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-100-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-102-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-103-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-105-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-106-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-108-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-110-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-111-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-112-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-114-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-116-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-118-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-119-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-122-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-124-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-123-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-121-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-120-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-117-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-115-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-113-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-109-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-107-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-104-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-101-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-95-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-86-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger
behavioral1/memory/1736-83-0x0000000000090000-0x0000000000138000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
agilenet

Processes:

resource yara_rule

behavioral1/memory/560-55-0x00000000003B0000-0x00000000003C4000-memory.dmp agile_net

yara_rule
masslogger_log_file

resource	yara_rule
behavioral1/memory/560-55-0x00000000003B0000-0x00000000003C4000-memory.dmp	agile_net

Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

PAGO_ADJ.exe

description pid process target process

PID 560 set thread context of 1736 560 PAGO_ADJ.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

PAGO_ADJ.exe

pid process

560 PAGO_ADJ.exe
560 PAGO_ADJ.exe
560 PAGO_ADJ.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PAGO_ADJ.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 560 PAGO_ADJ.exe
Token: SeDebugPrivilege 1736 InstallUtil.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 560 set thread context of 1736	560	PAGO_ADJ.exe	InstallUtil.exe

pid	process
560	PAGO_ADJ.exe
560	PAGO_ADJ.exe
560	PAGO_ADJ.exe

description	pid	process
Token: SeDebugPrivilege	560	PAGO_ADJ.exe
Token: SeDebugPrivilege	1736	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

PAGO_ADJ.exe

description	pid	process	target process
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe
PID 560 wrote to memory of 1736	560	PAGO_ADJ.exe	InstallUtil.exe

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\PAGO_ADJ.exe
"C:\Users\Admin\AppData\Local\Temp\PAGO_ADJ.exe"
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

00:00 00:00

Downloads

memory/560-54-0x00000000003F0000-0x0000000000532000-memory.dmp

Filesize
1MB

Download
memory/560-55-0x00000000003B0000-0x00000000003C4000-memory.dmp

Filesize
80KB

Download
memory/560-56-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/560-57-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/560-58-0x00000000009A0000-0x00000000009A8000-memory.dmp

Filesize
32KB

Download
memory/1736-59-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-60-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-62-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-63-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-65-0x00000000004A20FE-mapping.dmp

Download
memory/1736-67-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-66-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-71-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-74-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-75-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-76-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-77-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-78-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-79-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-80-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-81-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-82-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-84-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-85-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-87-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-88-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-89-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-90-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-91-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-92-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-93-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-94-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-96-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-97-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-98-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-99-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-100-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-102-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-103-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-105-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-106-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-108-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-110-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-111-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-112-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-114-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-116-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-118-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-119-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-122-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-124-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-123-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-121-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-120-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-117-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-115-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-113-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-109-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-107-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-104-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-101-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-95-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-86-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-83-0x0000000000090000-0x0000000000138000-memory.dmp

Filesize
672KB

Download
memory/1736-325-0x0000000004230000-0x0000000004274000-memory.dmp

Filesize
272KB

Download