masslogger | 4ec68b8b761b43381c19cf7457c9d0d7e0942d73c89bd4f57f91a34b4581fb78

General

Target

DHL_MAY_.exe
Size

816KB
MD5

4ea547efe0fcb7dde07eb2a9c6891040
SHA1

f45314bf78ce40bb81df533dbd6861260a609c4f
SHA256

cd5eeb8026313e1bcfff3db5c1e30ff15477427f16e23e885df3b57adceac0b6
SHA512

77f30789b5f08bf67522228d5cc818ebd12b0f681bca1d7f4f3b3694deb67c6528e8390b435fca0cadcb722aa789bb0e966e6c4f2434382c3660192d54db2025

Score

10^/10

masslogger collection ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:07:40 PM MassLogger Started: 5/21/2022 3:07:37 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.kogep-k.hu
Port:
587
Username:
dekgep@dekgep.hu
Password:
Vb^4ZJR[JffqT,F2Tb

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 32 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4612-136-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-139-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-141-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-143-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-145-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-147-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-149-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-151-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-153-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-155-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-157-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-159-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-161-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-163-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-165-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-167-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-169-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-171-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-173-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-175-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-177-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-179-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-181-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-183-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-185-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-187-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-189-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-191-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-193-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-195-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-199-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/4612-197-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DHL_MAY_.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	DHL_MAY_.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs

collection

Email Collection

T1114

Processes:

DHL_MAY_.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	DHL_MAY_.exe
Key queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	DHL_MAY_.exe
Key queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	DHL_MAY_.exe
Key queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL_MAY_.exe

description pid process target process

PID 1436 set thread context of 4612 1436 DHL_MAY_.exe DHL_MAY_.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DHL_MAY_.exeDHL_MAY_.exe

pid process

1436 DHL_MAY_.exe
1436 DHL_MAY_.exe
1436 DHL_MAY_.exe
4612 DHL_MAY_.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DHL_MAY_.exeDHL_MAY_.exe

description pid process

Token: SeDebugPrivilege 1436 DHL_MAY_.exe
Token: SeDebugPrivilege 4612 DHL_MAY_.exe

flow	ioc
19	api.ipify.org

description	pid	process	target process
PID 1436 set thread context of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe

pid	process
1436	DHL_MAY_.exe
1436	DHL_MAY_.exe
1436	DHL_MAY_.exe
4612	DHL_MAY_.exe

description	pid	process
Token: SeDebugPrivilege	1436	DHL_MAY_.exe
Token: SeDebugPrivilege	4612	DHL_MAY_.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

DHL_MAY_.exe

description	pid	process	target process
PID 1436 wrote to memory of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe
PID 1436 wrote to memory of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe
PID 1436 wrote to memory of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe
PID 1436 wrote to memory of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe
PID 1436 wrote to memory of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe
PID 1436 wrote to memory of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe
PID 1436 wrote to memory of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe
PID 1436 wrote to memory of 4612	1436	DHL_MAY_.exe	DHL_MAY_.exe

outlook_office_path 1 IoCs

Processes:

DHL_MAY_.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe

outlook_win_path 1 IoCs

Processes:

DHL_MAY_.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	DHL_MAY_.exe

C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe"
2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_MAY_.exe.log
Filesize
1KB

MD5
400f1cc1a0a0ce1cdabda365ab3368ce

SHA1
1ecf683f14271d84f3b6063493dce00ff5f42075

SHA256
c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765

SHA512
14c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45

Download Submit
memory/1436-131-0x0000000007C00000-0x00000000081A4000-memory.dmp

Filesize
5.6MB

Download
memory/1436-132-0x0000000007870000-0x0000000007902000-memory.dmp

Filesize
584KB

Download
memory/1436-133-0x0000000007860000-0x000000000786A000-memory.dmp

Filesize
40KB

Download
memory/1436-134-0x000000000B340000-0x000000000B3DC000-memory.dmp

Filesize
624KB

Download
memory/1436-130-0x0000000000560000-0x0000000000632000-memory.dmp

Filesize
840KB

Download
memory/4612-163-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-169-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-139-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-141-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-143-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-145-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-147-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-149-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-151-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-153-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-155-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-157-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-159-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-161-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-135-0x0000000000000000-mapping.dmp

Download
memory/4612-165-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-167-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-136-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-171-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-173-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-175-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-177-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-179-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-181-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-183-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-185-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-187-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-189-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-191-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-193-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-195-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-199-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-197-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4612-646-0x0000000005210000-0x0000000005276000-memory.dmp

Filesize
408KB

Download
memory/4612-647-0x0000000002540000-0x0000000002590000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads