masslogger | 3dece552bae40022a24574f60b1dca098221bc92f04808839928b86e48eedcbd

General

Target

PAGO_25_.exe
Size

1.2MB
MD5

94f2908697b9f698d5634f675dc6a5c8
SHA1

9e6e83f145c01bedd3ef800b16e675d990f9d39e
SHA256

79789ad11d75901af6b26bcb620abc4db6c1391c00544bf6d293760f98c3df76
SHA512

042c67a7da5cdff3e159d918bb8fdde12d6b5d176e9b51460d4703ed68b33562c58d98cd140064fae4f336196a0e23efe78545f7bd621f77c305516b78b96ce5

Score

10^/10

masslogger ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\781F780B4E\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:09:39 PM MassLogger Started: 5/21/2022 1:09:36 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 33 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3152-130-0x0000000000F60000-0x000000000109C000-memory.dmp	family_masslogger
behavioral2/memory/3164-136-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-140-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-142-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-144-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-146-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-148-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-150-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-152-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-154-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-156-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-158-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-160-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-162-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-164-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-166-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-168-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-170-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-172-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-174-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-176-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-178-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-180-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-182-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-184-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-186-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-188-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-190-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-192-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-194-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-196-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-198-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/3164-200-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file
Executes dropped EXE 1 IoCs

Processes:

InstallUtil.exe

pid process

3164 InstallUtil.exe

yara_rule
masslogger_log_file

pid	process
3164	InstallUtil.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

InstallUtil.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	InstallUtil.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

33 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

PAGO_25_.exe

description pid process target process

PID 3152 set thread context of 3164 3152 PAGO_25_.exe InstallUtil.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PAGO_25_.exeInstallUtil.exe

pid process

3152 PAGO_25_.exe
3152 PAGO_25_.exe
3152 PAGO_25_.exe
3164 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PAGO_25_.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 3152 PAGO_25_.exe
Token: SeDebugPrivilege 3164 InstallUtil.exe

flow	ioc
33	api.ipify.org

description	pid	process	target process
PID 3152 set thread context of 3164	3152	PAGO_25_.exe	InstallUtil.exe

pid	process
3152	PAGO_25_.exe
3152	PAGO_25_.exe
3152	PAGO_25_.exe
3164	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	3152	PAGO_25_.exe
Token: SeDebugPrivilege	3164	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PAGO_25_.exe

description	pid	process	target process
PID 3152 wrote to memory of 3164	3152	PAGO_25_.exe	InstallUtil.exe
PID 3152 wrote to memory of 3164	3152	PAGO_25_.exe	InstallUtil.exe
PID 3152 wrote to memory of 3164	3152	PAGO_25_.exe	InstallUtil.exe
PID 3152 wrote to memory of 3164	3152	PAGO_25_.exe	InstallUtil.exe
PID 3152 wrote to memory of 3164	3152	PAGO_25_.exe	InstallUtil.exe
PID 3152 wrote to memory of 3164	3152	PAGO_25_.exe	InstallUtil.exe
PID 3152 wrote to memory of 3164	3152	PAGO_25_.exe	InstallUtil.exe
PID 3152 wrote to memory of 3164	3152	PAGO_25_.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\PAGO_25_.exe
"C:\Users\Admin\AppData\Local\Temp\PAGO_25_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
memory/3152-131-0x00000000060C0000-0x0000000006664000-memory.dmp

Filesize
5.6MB

Download
memory/3152-132-0x0000000006810000-0x00000000068A2000-memory.dmp

Filesize
584KB

Download
memory/3152-133-0x0000000007560000-0x00000000075A4000-memory.dmp

Filesize
272KB

Download
memory/3152-134-0x00000000075B0000-0x00000000075D2000-memory.dmp

Filesize
136KB

Download
memory/3152-130-0x0000000000F60000-0x000000000109C000-memory.dmp

Filesize
1.2MB

Download
memory/3164-162-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-170-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-140-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-142-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-144-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-146-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-148-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-150-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-152-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-154-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-156-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-158-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-160-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-135-0x0000000000000000-mapping.dmp

Download
memory/3164-164-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-166-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-168-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-136-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-172-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-174-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-176-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-178-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-180-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-182-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-184-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-186-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-188-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-190-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-192-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-194-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-196-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-198-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-200-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3164-645-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/3164-646-0x0000000006500000-0x000000000650A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads