masslogger | 74481a89a60d1d7d276ee947d68cb4e5cead85fe915ff8a1f1b5bcc56133e79f

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2022, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
________.exe
Size 1.1MB
Sample220905-rs9ljadbb6
SHA256 2de7b732ee9b742f2be5a2ba8bf0cc3a6aadb4513948863a927efecd9324f94c
MD5 7d0c983da7b462a05e5df149e8a5b167
SHA1 27e97566577614b3d41c9f402e2b6ff4b2cc1c37
SHA512 330ca7a3d654c4c76598234cc4cbc156f1a69d124a8e44eec1b92cc98a318814cb488ec7213562a608382933adc56eedb29f0a13e7f24b89eb1346fa6b71b69a
SSDEEP 24576:AvSBaXsjdVZ52Zf/xzqFYCASYzP/hvIizJ2ISt/R9L/Y3K3+MYmhmvk4e5Sn:Av58xX52ZHMFWP/hvIizoIo/7L/Y39M4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main payload 1 IoCs

resource	yara_rule
behavioral2/memory/2444-139-0x0000000000400000-0x0000000000484000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 2444	4860	________.exe	96

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2444	________.exe
2444	________.exe
3552	powershell.exe
3552	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	________.exe
Token: SeDebugPrivilege	3552	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2444	4860	________.exe	96
PID 4860 wrote to memory of 2444	4860	________.exe	96
PID 4860 wrote to memory of 2444	4860	________.exe	96
PID 4860 wrote to memory of 2444	4860	________.exe	96
PID 4860 wrote to memory of 2444	4860	________.exe	96
PID 4860 wrote to memory of 2444	4860	________.exe	96
PID 4860 wrote to memory of 2444	4860	________.exe	96
PID 4860 wrote to memory of 2444	4860	________.exe	96
PID 2444 wrote to memory of 5040	2444	________.exe	97
PID 2444 wrote to memory of 5040	2444	________.exe	97
PID 2444 wrote to memory of 5040	2444	________.exe	97
PID 5040 wrote to memory of 3552	5040	cmd.exe	99
PID 5040 wrote to memory of 3552	5040	cmd.exe	99
PID 5040 wrote to memory of 3552	5040	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\________.exe
"C:\Users\Admin\AppData\Local\Temp\________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\________.exe
  "C:\Users\Admin\AppData\Local\Temp\________.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\________.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\________.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

________.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\________.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

memory/2444-139-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/3552-147-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/3552-148-0x0000000007730000-0x0000000007DAA000-memory.dmp

Download

memory/3552-151-0x00000000072B0000-0x00000000072D2000-memory.dmp

Download

memory/3552-150-0x0000000007350000-0x00000000073E6000-memory.dmp

Download

memory/3552-149-0x0000000006600000-0x000000000661A000-memory.dmp

Download

memory/3552-146-0x0000000005A20000-0x0000000005A86000-memory.dmp

Download

memory/3552-145-0x0000000005340000-0x0000000005362000-memory.dmp

Download

memory/3552-143-0x0000000004B60000-0x0000000004B96000-memory.dmp

Download

memory/3552-144-0x0000000005380000-0x00000000059A8000-memory.dmp

Download

memory/4860-133-0x0000000008240000-0x00000000087E4000-memory.dmp

Download

memory/4860-132-0x0000000000DD0000-0x0000000000EF6000-memory.dmp

Download

memory/4860-136-0x000000000BA00000-0x000000000BA9C000-memory.dmp

Download

memory/4860-134-0x0000000007D70000-0x0000000007E02000-memory.dmp

Download

memory/4860-135-0x0000000007F00000-0x0000000007F0A000-memory.dmp

Download

memory/4860-137-0x000000000BAC0000-0x000000000BB26000-memory.dmp

Download