masslogger | bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be

General

Target

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
Size

923KB
MD5

22a544c96d4373c1bb70ab10616d6dfc
SHA1

24d6958135e39dd8ac536ebc6385f200566cfa11
SHA256

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be
SHA512

9530ec552ef5380087161157530f5d9b5c8640d656e962e733b7c94cfa646e1f861cccbcb6a4cd583801e5d4a6b258a2a931b28f07edeb353b6eb8ba223947f2

Score

10^/10

masslogger coreentity ransomware rezer0 spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\79FE0CC911\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/24/2022 5:30:26 PM MassLogger Started: 5/24/2022 5:30:19 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1100-56-0x0000000000300000-0x0000000000308000-memory.dmp	coreentity

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1100-57-0x00000000074E0000-0x0000000007590000-memory.dmp	rezer0

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

description	pid	process	target process
PID 1100 set thread context of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

pid process

2044 bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

description pid process

Token: SeDebugPrivilege 2044 bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

pid	process
2044	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

description	pid	process
Token: SeDebugPrivilege	2044	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

description	pid	process	target process
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
PID 1100 wrote to memory of 2044	1100	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe	bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe

C:\Users\Admin\AppData\Local\Temp\bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
"C:\Users\Admin\AppData\Local\Temp\bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100

C:\Users\Admin\AppData\Local\Temp\bb8d3a66ecd0ba5f13e77d65445f34b252dd1382b44b30f5447cd599655907be.exe
"{path}"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-54-0x0000000001040000-0x000000000112C000-memory.dmp

Filesize
944KB

Download
memory/1100-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1100-56-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/1100-57-0x00000000074E0000-0x0000000007590000-memory.dmp

Filesize
704KB

Download
memory/2044-58-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-59-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-61-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-62-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-63-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-64-0x00000000004A33CE-mapping.dmp

Download
memory/2044-66-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-68-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-70-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-72-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-74-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-76-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-78-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-80-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-82-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-84-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-86-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-88-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-90-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-92-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-94-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-96-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-98-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-100-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-102-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-104-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-106-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-108-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-110-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-112-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-114-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-116-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-118-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-120-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2044-578-0x0000000004EF5000-0x0000000004F06000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads