masslogger | 53c05a4b75e539caed8efe3f60af055da27c014c2f8ba6f9a05981fc2e073e59

General

Target

PAGO_ADJ.exe
Size

1.2MB
MD5

b69ef4759dddf4f965bf84d654a555ff
SHA1

f894b62e29c20cdd562f02001c5ce30ca5609bb9
SHA256

7ecde113e9bcf315e61368cce51deda2e51321684d9d8e943a31ab1d457988f7
SHA512

529766ef4faa26b9c5e8a2bffd390c64d038724a7492caf5790550062c195ba5d6f2c2d97ad0e6fc5e2a03bf4fc3af6b41c0c4a3a7db9b0fa2e33884f38827cb

Score

10^/10

masslogger collection ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\781F780B4E\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.2.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:34:47 PM MassLogger Started: 5/21/2022 12:34:43 PM Interval: 6 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe As Administrator: True

Extracted

Credentials

Protocol: ftp
Host:
ftp.sisbg.net
Port:
21
Username:
ntums@sisbg.net
Password:
alibaba.com

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 33 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2992-130-0x0000000000540000-0x0000000000682000-memory.dmp	family_masslogger
behavioral2/memory/4424-135-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-137-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-139-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-141-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-143-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-147-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-145-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-149-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-151-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-153-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-155-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-157-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-159-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-161-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-163-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-165-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-167-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-169-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-171-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-173-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-175-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-177-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-181-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-179-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-183-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-185-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-187-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-189-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-191-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-193-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-195-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4424-197-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	InstallUtil.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

34 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

PAGO_ADJ.exe

description pid process target process

PID 2992 set thread context of 4424 2992 PAGO_ADJ.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

PAGO_ADJ.exe

pid process

2992 PAGO_ADJ.exe
2992 PAGO_ADJ.exe
2992 PAGO_ADJ.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PAGO_ADJ.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 2992 PAGO_ADJ.exe
Token: SeDebugPrivilege 4424 InstallUtil.exe

flow	ioc
34	api.ipify.org

description	pid	process	target process
PID 2992 set thread context of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe

pid	process
2992	PAGO_ADJ.exe
2992	PAGO_ADJ.exe
2992	PAGO_ADJ.exe

description	pid	process
Token: SeDebugPrivilege	2992	PAGO_ADJ.exe
Token: SeDebugPrivilege	4424	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PAGO_ADJ.exe

description	pid	process	target process
PID 2992 wrote to memory of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe
PID 2992 wrote to memory of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe
PID 2992 wrote to memory of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe
PID 2992 wrote to memory of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe
PID 2992 wrote to memory of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe
PID 2992 wrote to memory of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe
PID 2992 wrote to memory of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe
PID 2992 wrote to memory of 4424	2992	PAGO_ADJ.exe	InstallUtil.exe

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\PAGO_ADJ.exe
"C:\Users\Admin\AppData\Local\Temp\PAGO_ADJ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-130-0x0000000000540000-0x0000000000682000-memory.dmp

Filesize
1.3MB

Download
memory/2992-131-0x0000000005600000-0x0000000005BA4000-memory.dmp

Filesize
5.6MB

Download
memory/2992-132-0x0000000005150000-0x00000000051E2000-memory.dmp

Filesize
584KB

Download
memory/2992-133-0x00000000052F0000-0x0000000005334000-memory.dmp

Filesize
272KB

Download
memory/4424-134-0x0000000000000000-mapping.dmp

Download
memory/4424-135-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-137-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-139-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-141-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-143-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-147-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-145-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-149-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-151-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-153-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-155-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-157-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-159-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-161-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-163-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-165-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-167-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-169-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-171-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-173-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-175-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-177-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-181-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-179-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-183-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-185-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-187-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-189-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-191-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-193-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-195-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-197-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4424-634-0x0000000006050000-0x00000000060B6000-memory.dmp

Filesize
408KB

Download
memory/4424-635-0x00000000063F0000-0x00000000063FA000-memory.dmp

Filesize
40KB

Download
memory/4424-636-0x0000000006830000-0x0000000006880000-memory.dmp

Filesize
320KB

Download
memory/4424-637-0x0000000006A20000-0x0000000006ABC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads