m00nd3v_logger | fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6

Analysis

max time kernel
34s
max time network
41s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 20:55

Target

fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe
Size

2.0MB
MD5

83aebff419895e406911862d5ee7a029
SHA1

2d5545557538754a98258dc4cbf6af55fb065808
SHA256

fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6
SHA512

ff3817928467ebad1821fad2d319d22a374863a0c3bbb70a5e2babf9256968fb427f9f7455f85dd506d3ac260eaa2ce177cdd64f998fabc40dbb57e6b8a7a1fa

Score

10^/10

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1524-58-0x00000000022D0000-0x0000000002360000-memory.dmp	m00nd3v_logger

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe

pid	process
1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe
1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe
1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe

description pid process

Token: SeDebugPrivilege 1524 fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe

description	pid	process
Token: SeDebugPrivilege	1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe

description	pid	process	target process
PID 1524 wrote to memory of 900	1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe	RegAsm.exe
PID 1524 wrote to memory of 900	1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe	RegAsm.exe
PID 1524 wrote to memory of 900	1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe	RegAsm.exe
PID 1524 wrote to memory of 900	1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe	RegAsm.exe
PID 1524 wrote to memory of 900	1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe	RegAsm.exe
PID 1524 wrote to memory of 900	1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe	RegAsm.exe
PID 1524 wrote to memory of 900	1524	fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:900

memory/1524-54-0x00000000000B0000-0x00000000002B2000-memory.dmp

Filesize
2.0MB

Download
memory/1524-55-0x0000000076311000-0x0000000076313000-memory.dmp

Filesize
8KB

Download
memory/1524-56-0x0000000004EE0000-0x0000000004FA4000-memory.dmp

Filesize
784KB

Download
memory/1524-57-0x00000000006B0000-0x00000000006D8000-memory.dmp

Filesize
160KB

Download
memory/1524-58-0x00000000022D0000-0x0000000002360000-memory.dmp

Filesize
576KB

Download