masslogger | f49a52f841c0947006b687698efd2349648fb3c5aea51fbfaa099b5a5ab30463

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24/05/2022, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Agency Fund JUNE20_Revised.exe
Size

948KB
MD5

cfdd2d3dc883211f7a6f934e4b295714
SHA1

e7deccd6d0685263d69a4cdff890baa0865770b1
SHA256

98ec6884be9b64e2e37a37460bd3d8ca770f2ef2d1d5cd4b6321a01462c8d32b
SHA512

b14684e7d37c884eb2da0066ddf694360a56f279be55f8335985c0a82882b54f39f42e4fd991e77f5e394d6f29b386194365003c6dd048c6d5ed87c2172073a7

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 32 IoCs

resource	yara_rule
behavioral2/memory/4664-137-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-140-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-142-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-144-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-146-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-148-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-150-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-152-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-154-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-156-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-158-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-160-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-162-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-164-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-166-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-168-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-170-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-172-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-174-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-176-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-178-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-180-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-182-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-184-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-186-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-188-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-190-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-192-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-194-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-196-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-198-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger
behavioral2/memory/4664-200-0x0000000000400000-0x00000000004A8000-memory.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Agency Fund JUNE20_Revised.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 4664	3048	Agency Fund JUNE20_Revised.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3048	Agency Fund JUNE20_Revised.exe
8	powershell.exe
8	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	Agency Fund JUNE20_Revised.exe
Token: SeDebugPrivilege	4664	Agency Fund JUNE20_Revised.exe
Token: SeDebugPrivilege	8	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 220	3048	Agency Fund JUNE20_Revised.exe	88
PID 3048 wrote to memory of 220	3048	Agency Fund JUNE20_Revised.exe	88
PID 3048 wrote to memory of 220	3048	Agency Fund JUNE20_Revised.exe	88
PID 3048 wrote to memory of 4664	3048	Agency Fund JUNE20_Revised.exe	90
PID 3048 wrote to memory of 4664	3048	Agency Fund JUNE20_Revised.exe	90
PID 3048 wrote to memory of 4664	3048	Agency Fund JUNE20_Revised.exe	90
PID 3048 wrote to memory of 4664	3048	Agency Fund JUNE20_Revised.exe	90
PID 3048 wrote to memory of 4664	3048	Agency Fund JUNE20_Revised.exe	90
PID 3048 wrote to memory of 4664	3048	Agency Fund JUNE20_Revised.exe	90
PID 3048 wrote to memory of 4664	3048	Agency Fund JUNE20_Revised.exe	90
PID 3048 wrote to memory of 4664	3048	Agency Fund JUNE20_Revised.exe	90
PID 4664 wrote to memory of 4008	4664	Agency Fund JUNE20_Revised.exe	91
PID 4664 wrote to memory of 4008	4664	Agency Fund JUNE20_Revised.exe	91
PID 4664 wrote to memory of 4008	4664	Agency Fund JUNE20_Revised.exe	91
PID 4008 wrote to memory of 8	4008	cmd.exe	93
PID 4008 wrote to memory of 8	4008	cmd.exe	93
PID 4008 wrote to memory of 8	4008	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\Agency Fund JUNE20_Revised.exe
"C:\Users\Admin\AppData\Local\Temp\Agency Fund JUNE20_Revised.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BCUUDgKljBWP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp30B5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:220
- C:\Users\Admin\AppData\Local\Temp\Agency Fund JUNE20_Revised.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Agency Fund JUNE20_Revised.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Agency Fund JUNE20_Revised.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:8

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Agency Fund JUNE20_Revised.exe.log

Filesize
507B

MD5
ab4c71d3ff6255edd4e5c1e09540f49e

SHA1
22e06bf4e258741b5df918061871cba998c50cea

SHA256
1690fec628f775dd3c3385b800eed126b37978ef2ffd592b024052724caafb5a

SHA512
8fa7d0045796e6cda7c28e2b9a690ef550619828c1b5d0ebf8e8367aff4bf4d9f63121e5b4f199d30cb8006eb584c6767f4c59150749b8256dab9dd0ebd9f1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp30B5.tmp

Filesize
1KB

MD5
0cdc1b1187f026dcffe33c41e6738fe9

SHA1
680f5713784a5bcf570b029321fc8cc479915e52

SHA256
37a1a4fd21ce30d5ad27ef1ad86e3465d06e1b4426bddd49badba675621b3f91

SHA512
2789615173c0f7a69fa46a0eb16c95fc3232e04ed32cf0fc6e500b2dc49f9028e5f4dfb64fa0b4dce927fafab2895c54c5da3b8415e799b491abf281fddb344e

Download Submit
memory/8-656-0x0000000006530000-0x0000000006552000-memory.dmp

Filesize
136KB

Download
memory/8-648-0x0000000002660000-0x0000000002696000-memory.dmp

Filesize
216KB

Download
memory/8-649-0x0000000005030000-0x0000000005658000-memory.dmp

Filesize
6.2MB

Download
memory/8-650-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

Filesize
136KB

Download
memory/8-651-0x0000000005890000-0x00000000058F6000-memory.dmp

Filesize
408KB

Download
memory/8-652-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Filesize
120KB

Download
memory/8-655-0x0000000006FD0000-0x0000000007066000-memory.dmp

Filesize
600KB

Download
memory/8-654-0x0000000006470000-0x000000000648A000-memory.dmp

Filesize
104KB

Download
memory/8-653-0x00000000075B0000-0x0000000007C2A000-memory.dmp

Filesize
6.5MB

Download
memory/3048-130-0x00000000000D0000-0x00000000001C4000-memory.dmp

Filesize
976KB

Download
memory/3048-133-0x0000000005B60000-0x0000000006104000-memory.dmp

Filesize
5.6MB

Download
memory/3048-132-0x0000000004CF0000-0x0000000004D82000-memory.dmp

Filesize
584KB

Download
memory/3048-131-0x0000000004B70000-0x0000000004C0C000-memory.dmp

Filesize
624KB

Download
memory/4664-170-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-188-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-158-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-160-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-162-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-164-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-166-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-168-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-154-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-172-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-174-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-176-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-178-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-180-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-182-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-184-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-186-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-156-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-190-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-192-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-194-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-196-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-198-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-152-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-150-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-148-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-146-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-144-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-142-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-140-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-137-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-200-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4664-645-0x0000000005500000-0x0000000005566000-memory.dmp

Filesize
408KB

Download