masslogger | 8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8

Analysis

max time kernel
102s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-05-2022 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe
Size

798KB
MD5

416c6c0776664f4985d665764eb28fbc
SHA1

26cf9f67fd3b9286d71036d2da2d207f2727fe77
SHA256

8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8
SHA512

1d488a73781bfe88b4320eda583762cac4bbf7eba7a6842eaca17f444ff4c31713306e66efc2e338d93282a2a9fb772a1ff7779ab9aa88bfcefcdbc58c163b0b

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 32 IoCs

resource	yara_rule
behavioral2/memory/384-136-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-139-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-145-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-155-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-161-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-159-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-157-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-171-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-179-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-187-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-193-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-199-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-197-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-195-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-191-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-189-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-185-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-183-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-181-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-177-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-175-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-173-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-169-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-167-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-165-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-163-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-153-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-151-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-149-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-147-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-143-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger
behavioral2/memory/384-141-0x0000000000400000-0x00000000004AA000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3348	powershell.exe
3348	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe
Token: SeDebugPrivilege	3348	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81
PID 1052 wrote to memory of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81
PID 1052 wrote to memory of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81
PID 1052 wrote to memory of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81
PID 1052 wrote to memory of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81
PID 1052 wrote to memory of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81
PID 1052 wrote to memory of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81
PID 1052 wrote to memory of 384	1052	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	81
PID 384 wrote to memory of 2104	384	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	85
PID 384 wrote to memory of 2104	384	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	85
PID 384 wrote to memory of 2104	384	8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe	85
PID 2104 wrote to memory of 3348	2104	cmd.exe	88
PID 2104 wrote to memory of 3348	2104	cmd.exe	88
PID 2104 wrote to memory of 3348	2104	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe
"C:\Users\Admin\AppData\Local\Temp\8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8a11b451d016d26d350ad4d913de3af9e8ffa77e945955b26e89d23951ada1e8.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/384-169-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-155-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-167-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-145-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-165-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-161-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-159-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-157-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-171-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-179-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-187-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-193-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-199-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-197-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-195-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-163-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-189-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-185-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-183-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-181-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-177-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-175-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-173-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-136-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-139-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-191-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-153-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-151-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-149-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-147-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-143-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-141-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/384-646-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/1052-133-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1052-131-0x0000000005EE0000-0x0000000006484000-memory.dmp

Filesize
5.6MB

Download
memory/1052-132-0x00000000059D0000-0x0000000005A62000-memory.dmp

Filesize
584KB

Download
memory/1052-134-0x0000000008220000-0x00000000082BC000-memory.dmp

Filesize
624KB

Download
memory/1052-130-0x0000000000F50000-0x000000000101E000-memory.dmp

Filesize
824KB

Download
memory/3348-651-0x0000000005160000-0x0000000005182000-memory.dmp

Filesize
136KB

Download
memory/3348-649-0x00000000027F0000-0x0000000002826000-memory.dmp

Filesize
216KB

Download
memory/3348-650-0x00000000052B0000-0x00000000058D8000-memory.dmp

Filesize
6.2MB

Download
memory/3348-652-0x0000000005950000-0x00000000059B6000-memory.dmp

Filesize
408KB

Download
memory/3348-653-0x0000000006100000-0x000000000611E000-memory.dmp

Filesize
120KB

Download
memory/3348-655-0x00000000065F0000-0x000000000660A000-memory.dmp

Filesize
104KB

Download
memory/3348-654-0x00000000077C0000-0x0000000007E3A000-memory.dmp

Filesize
6.5MB

Download
memory/3348-657-0x00000000066D0000-0x00000000066F2000-memory.dmp

Filesize
136KB

Download
memory/3348-656-0x00000000073E0000-0x0000000007476000-memory.dmp

Filesize
600KB

Download