masslogger | 74481a89a60d1d7d276ee947d68cb4e5cead85fe915ff8a1f1b5bcc56133e79f

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

________.exe
Size

1.1MB
MD5

7d0c983da7b462a05e5df149e8a5b167
SHA1

27e97566577614b3d41c9f402e2b6ff4b2cc1c37
SHA256

2de7b732ee9b742f2be5a2ba8bf0cc3a6aadb4513948863a927efecd9324f94c
SHA512

330ca7a3d654c4c76598234cc4cbc156f1a69d124a8e44eec1b92cc98a318814cb488ec7213562a608382933adc56eedb29f0a13e7f24b89eb1346fa6b71b69a
SSDEEP

24576:AvSBaXsjdVZ52Zf/xzqFYCASYzP/hvIizJ2ISt/R9L/Y3K3+MYmhmvk4e5Sn:Av58xX52ZHMFWP/hvIizoIo/7L/Y39M4

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2444-139-0x0000000000400000-0x0000000000484000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

________.exe

description pid process target process

PID 4860 set thread context of 2444 4860 ________.exe ________.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

________.exepowershell.exe

pid process

2444 ________.exe
2444 ________.exe
3552 powershell.exe
3552 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

________.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2444 ________.exe
Token: SeDebugPrivilege 3552 powershell.exe

description	pid	process	target process
PID 4860 set thread context of 2444	4860	________.exe	________.exe

pid	process
2444	________.exe
2444	________.exe
3552	powershell.exe
3552	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2444	________.exe
Token: SeDebugPrivilege	3552	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

________.exe________.execmd.exe

description	pid	process	target process
PID 4860 wrote to memory of 2444	4860	________.exe	________.exe
PID 4860 wrote to memory of 2444	4860	________.exe	________.exe
PID 4860 wrote to memory of 2444	4860	________.exe	________.exe
PID 4860 wrote to memory of 2444	4860	________.exe	________.exe
PID 4860 wrote to memory of 2444	4860	________.exe	________.exe
PID 4860 wrote to memory of 2444	4860	________.exe	________.exe
PID 4860 wrote to memory of 2444	4860	________.exe	________.exe
PID 4860 wrote to memory of 2444	4860	________.exe	________.exe
PID 2444 wrote to memory of 5040	2444	________.exe	cmd.exe
PID 2444 wrote to memory of 5040	2444	________.exe	cmd.exe
PID 2444 wrote to memory of 5040	2444	________.exe	cmd.exe
PID 5040 wrote to memory of 3552	5040	cmd.exe	powershell.exe
PID 5040 wrote to memory of 3552	5040	cmd.exe	powershell.exe
PID 5040 wrote to memory of 3552	5040	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\________.exe
"C:\Users\Admin\AppData\Local\Temp\________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4860

C:\Users\Admin\AppData\Local\Temp\________.exe
"C:\Users\Admin\AppData\Local\Temp\________.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\________.exe' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\________.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\________.exe.log
Filesize
1KB

MD5
e08f822522c617a40840c62e4b0fb45e

SHA1
ae516dca4da5234be6676d3f234c19ec55725be7

SHA256
bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7

SHA512
894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4

Download Submit
memory/2444-138-0x0000000000000000-mapping.dmp

Download
memory/2444-139-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3552-147-0x0000000006110000-0x000000000612E000-memory.dmp

Filesize
120KB

Download
memory/3552-148-0x0000000007730000-0x0000000007DAA000-memory.dmp

Filesize
6.5MB

Download
memory/3552-151-0x00000000072B0000-0x00000000072D2000-memory.dmp

Filesize
136KB

Download
memory/3552-150-0x0000000007350000-0x00000000073E6000-memory.dmp

Filesize
600KB

Download
memory/3552-149-0x0000000006600000-0x000000000661A000-memory.dmp

Filesize
104KB

Download
memory/3552-146-0x0000000005A20000-0x0000000005A86000-memory.dmp

Filesize
408KB

Download
memory/3552-145-0x0000000005340000-0x0000000005362000-memory.dmp

Filesize
136KB

Download
memory/3552-142-0x0000000000000000-mapping.dmp

Download
memory/3552-143-0x0000000004B60000-0x0000000004B96000-memory.dmp

Filesize
216KB

Download
memory/3552-144-0x0000000005380000-0x00000000059A8000-memory.dmp

Filesize
6.2MB

Download
memory/4860-133-0x0000000008240000-0x00000000087E4000-memory.dmp

Filesize
5.6MB

Download
memory/4860-132-0x0000000000DD0000-0x0000000000EF6000-memory.dmp

Filesize
1.1MB

Download
memory/4860-136-0x000000000BA00000-0x000000000BA9C000-memory.dmp

Filesize
624KB

Download
memory/4860-134-0x0000000007D70000-0x0000000007E02000-memory.dmp

Filesize
584KB

Download
memory/4860-135-0x0000000007F00000-0x0000000007F0A000-memory.dmp

Filesize
40KB

Download
memory/4860-137-0x000000000BAC0000-0x000000000BB26000-memory.dmp

Filesize
408KB

Download
memory/5040-140-0x0000000000000000-mapping.dmp

Download