masslogger | 35427be7bfbf3eed5c87a1567c0ede26d41c7653c3bb06e28c65f28d3263a5e4

Analysis

max time kernel
45s
max time network
133s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation_Sheet_PO_including FOB_MOQ.PDF.exe
Size

756KB
MD5

a59a17e0750535499b455d7e2bf4b4ff
SHA1

d659c6f80171c2142aa0b9f0352205ae6a79ca4d
SHA256

c2be817a60ed0f80dc7f6e3e5eafc3db7a7a170e1df0015e2189cd9daecec6c8
SHA512

83bab7d199df6dadc8ca1d8c3cb38bc8cf466309d25ee92b3579ea30eac012154b20c9193367f09441619c0e08a0134123cf89d97972a43aaac42a9bff212354

Score

10^/10

masslogger ransomware rezer0 spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 1:09:10 PM MassLogger Started: 5/21/2022 1:09:03 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Quotation_Sheet_PO_including FOB_MOQ.PDF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger log file 1 IoCs

Detects a log file produced by MassLogger.

yara_rule
masslogger_log_file

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/1948-57-0x0000000005E00000-0x0000000005EB8000-memory.dmp	rezer0

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1064	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1144	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	27
PID 1948 wrote to memory of 1144	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	27
PID 1948 wrote to memory of 1144	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	27
PID 1948 wrote to memory of 1144	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	27
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29
PID 1948 wrote to memory of 1064	1948	Quotation_Sheet_PO_including FOB_MOQ.PDF.exe	29

C:\Users\Admin\AppData\Local\Temp\Quotation_Sheet_PO_including FOB_MOQ.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation_Sheet_PO_including FOB_MOQ.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OtuxuaaSs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\Quotation_Sheet_PO_including FOB_MOQ.PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation_Sheet_PO_including FOB_MOQ.PDF.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp

Filesize
1KB

MD5
bd62cd91d6caa3a9a6ed8c1edf8704f7

SHA1
03bbaa70e9587948bf3127ac3085750fc0a7bc21

SHA256
28f427c7d4fd5d984f7b912a41cb9534e873dbd100a37087a9c1adf1d9184da2

SHA512
dce818d0f43a46d6a8999abc7de0b4080118cd1f5628097ae40c744313208aa1cdd7cd962b80559fbc315139b65dda8034c89c5ac4f6579c8198669d7f0ef7bc

Download Submit
memory/1064-84-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-63-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-579-0x0000000004D55000-0x0000000004D66000-memory.dmp

Filesize
68KB

Download
memory/1064-86-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-577-0x00000000006C0000-0x0000000000704000-memory.dmp

Filesize
272KB

Download
memory/1064-90-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-61-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-88-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-64-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-65-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-68-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-70-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-72-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-74-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-76-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-78-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-80-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-82-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-122-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-120-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-118-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-60-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-92-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-94-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-96-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-98-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-100-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-102-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-104-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-106-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-108-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-110-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-112-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-114-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1064-116-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1948-56-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download
memory/1948-54-0x0000000000040000-0x0000000000104000-memory.dmp

Filesize
784KB

Download
memory/1948-55-0x0000000076571000-0x0000000076573000-memory.dmp

Filesize
8KB

Download
memory/1948-57-0x0000000005E00000-0x0000000005EB8000-memory.dmp

Filesize
736KB

Download