masslogger | 436721c75699b2ced805e19545c98e72f8d9e3d2e93efdbba086911e98757036

General

Target

DHL_MAY_.exe
Size

1.3MB
MD5

8f8abb6f33adbb7043c405bba2c19968
SHA1

fcdd38b2b364d32b4294c3a0611f011afc0fd3f0
SHA256

a3597ac0873ae3a71729eed1521710b6899ed9d886601b4b9e2ed207db1f087c
SHA512

a04ebec5e31d4c91bfae3d601d91579e1d7c5ff08a8499b0c93faa53eab355ed137629806b18c655ee549d08272b8f5d3a608d526095e9fb7b601ffbbf5e15f3

Score

10^/10

masslogger agilenet ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 12:49:03 PM MassLogger Started: 5/21/2022 12:48:52 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1564-54-0x00000000009B0000-0x0000000000B04000-memory.dmp	family_masslogger
behavioral1/memory/1688-61-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-62-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-63-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-64-0x00000000004ABEAE-mapping.dmp	family_masslogger
behavioral1/memory/1688-66-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-68-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-70-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-72-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-74-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-76-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-78-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-80-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-82-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-84-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-86-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-88-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-90-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-92-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-94-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-96-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-98-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-100-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-102-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-104-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-106-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-108-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-110-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-112-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-114-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-116-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-118-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-120-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral1/memory/1688-122-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DHL_MAY_.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	DHL_MAY_.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1564-55-0x0000000000470000-0x0000000000484000-memory.dmp	agile_net

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL_MAY_.exe

description pid process target process

PID 1564 set thread context of 1688 1564 DHL_MAY_.exe DHL_MAY_.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DHL_MAY_.exeDHL_MAY_.exe

pid process

1564 DHL_MAY_.exe
1564 DHL_MAY_.exe
1564 DHL_MAY_.exe
1688 DHL_MAY_.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DHL_MAY_.exeDHL_MAY_.exe

description pid process

Token: SeDebugPrivilege 1564 DHL_MAY_.exe
Token: SeDebugPrivilege 1688 DHL_MAY_.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 1564 set thread context of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe

pid	process
1564	DHL_MAY_.exe
1564	DHL_MAY_.exe
1564	DHL_MAY_.exe
1688	DHL_MAY_.exe

description	pid	process
Token: SeDebugPrivilege	1564	DHL_MAY_.exe
Token: SeDebugPrivilege	1688	DHL_MAY_.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

DHL_MAY_.exe

description	pid	process	target process
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe
PID 1564 wrote to memory of 1688	1564	DHL_MAY_.exe	DHL_MAY_.exe

C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-54-0x00000000009B0000-0x0000000000B04000-memory.dmp

Filesize
1.3MB

Download
memory/1564-55-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/1564-56-0x0000000000500000-0x0000000000508000-memory.dmp

Filesize
32KB

Download
memory/1564-57-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/1688-58-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-59-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-61-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-62-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-63-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-64-0x00000000004ABEAE-mapping.dmp

Download
memory/1688-66-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-68-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-70-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-72-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-74-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-76-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-78-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-80-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-82-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-84-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-86-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-88-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-90-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-92-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-94-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-96-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-98-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-100-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-102-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-104-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-106-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-108-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-110-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-112-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-114-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-116-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-118-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-120-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-122-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1688-577-0x00000000004C0000-0x0000000000504000-memory.dmp

Filesize
272KB

Download
memory/1688-579-0x0000000004B55000-0x0000000004B66000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads