masslogger | 436721c75699b2ced805e19545c98e72f8d9e3d2e93efdbba086911e98757036

General

Target

DHL_MAY_.exe
Size

1.3MB
MD5

8f8abb6f33adbb7043c405bba2c19968
SHA1

fcdd38b2b364d32b4294c3a0611f011afc0fd3f0
SHA256

a3597ac0873ae3a71729eed1521710b6899ed9d886601b4b9e2ed207db1f087c
SHA512

a04ebec5e31d4c91bfae3d601d91579e1d7c5ff08a8499b0c93faa53eab355ed137629806b18c655ee549d08272b8f5d3a608d526095e9fb7b601ffbbf5e15f3

Score

10^/10

masslogger ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8236ADF044\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:48:30 PM MassLogger Started: 5/21/2022 2:48:27 PM Interval: 96 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 33 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4100-130-0x0000000000B50000-0x0000000000CA4000-memory.dmp	family_masslogger
behavioral2/memory/372-136-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-139-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-141-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-145-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-143-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-147-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-149-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-151-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-153-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-155-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-157-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-159-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-161-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-163-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-165-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-167-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-169-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-171-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-173-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-177-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-175-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-179-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-181-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-183-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-185-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-187-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-189-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-191-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-193-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-195-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-197-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger
behavioral2/memory/372-199-0x0000000000400000-0x00000000004B0000-memory.dmp	family_masslogger

MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DHL_MAY_.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	DHL_MAY_.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

32 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL_MAY_.exe

description pid process target process

PID 4100 set thread context of 372 4100 DHL_MAY_.exe DHL_MAY_.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DHL_MAY_.exeDHL_MAY_.exe

pid process

4100 DHL_MAY_.exe
4100 DHL_MAY_.exe
4100 DHL_MAY_.exe
372 DHL_MAY_.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DHL_MAY_.exeDHL_MAY_.exe

description pid process

Token: SeDebugPrivilege 4100 DHL_MAY_.exe
Token: SeDebugPrivilege 372 DHL_MAY_.exe

flow	ioc
32	api.ipify.org

description	pid	process	target process
PID 4100 set thread context of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe

pid	process
4100	DHL_MAY_.exe
4100	DHL_MAY_.exe
4100	DHL_MAY_.exe
372	DHL_MAY_.exe

description	pid	process
Token: SeDebugPrivilege	4100	DHL_MAY_.exe
Token: SeDebugPrivilege	372	DHL_MAY_.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

DHL_MAY_.exe

description	pid	process	target process
PID 4100 wrote to memory of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe
PID 4100 wrote to memory of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe
PID 4100 wrote to memory of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe
PID 4100 wrote to memory of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe
PID 4100 wrote to memory of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe
PID 4100 wrote to memory of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe
PID 4100 wrote to memory of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe
PID 4100 wrote to memory of 372	4100	DHL_MAY_.exe	DHL_MAY_.exe

C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100

C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_MAY_.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_MAY_.exe.log
Filesize
1KB

MD5
1d7270c8103993217cd2ff7bdc3abd47

SHA1
d0c8dab21cb0705974d03470e049ac5be4b1668a

SHA256
0c168c7df7f397407352c8d5e410c40b479db3397f5361bac0a6feddb7181af5

SHA512
24ab57e495c83bfe127263310a4ad872617dd0d5b72475422bc2e6f796829232e8e461aa837244f9b15485ec89a2d451907b55b3715b8154178905bdbd679e68

Download Submit
memory/372-163-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-139-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-648-0x0000000006A30000-0x0000000006A3A000-memory.dmp

Filesize
40KB

Download
memory/372-165-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-135-0x0000000000000000-mapping.dmp

Download
memory/372-169-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-647-0x0000000005550000-0x00000000055B6000-memory.dmp

Filesize
408KB

Download
memory/372-167-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-141-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-145-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-143-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-147-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-149-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-151-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-153-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-155-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-157-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-159-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-161-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-646-0x00000000050A0000-0x000000000513C000-memory.dmp

Filesize
624KB

Download
memory/372-199-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-197-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-136-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-171-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-173-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-177-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-175-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-179-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-181-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-183-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-185-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-187-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-189-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-191-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-193-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/372-195-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4100-132-0x00000000056B0000-0x0000000005742000-memory.dmp

Filesize
584KB

Download
memory/4100-134-0x00000000071E0000-0x0000000007202000-memory.dmp

Filesize
136KB

Download
memory/4100-130-0x0000000000B50000-0x0000000000CA4000-memory.dmp

Filesize
1.3MB

Download
memory/4100-131-0x0000000005BC0000-0x0000000006164000-memory.dmp

Filesize
5.6MB

Download
memory/4100-133-0x0000000005A50000-0x0000000005A94000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads