masslogger | 941401b8cc0345e99b5366597242c44f064794bd238938d647b0bc3ffa99277e

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2022 05:44

Target

SecuriteInfo.com.Win32.Malware-gen.21488.exe
Size

603KB
MD5

d782073248fad33f6bb618a06656179c
SHA1

661b8054400f4c07a55dbfb6a63176bf07902ea0
SHA256

941401b8cc0345e99b5366597242c44f064794bd238938d647b0bc3ffa99277e
SHA512

6cff9a3cc883a422d843b8753150dbdac780f94280ffc41c23ca76ae1f113a20d222f7bc5c7d4a5748127f21f1e078da421aba042784571f58df2caa5f648bab
SSDEEP

12288:l0LPjok8q2BrCq379Txwj3Z5yUpFQYC+32HvGe0oCRpCK2nbihGE0Gj7w:KUswTx0J5CYCgQN0HQ3bT

Score

10^/10

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4804-134-0x0000000000400000-0x0000000000484000-memory.dmp	family_masslogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.Malware-gen.21488.exe

description pid process target process

PID 2084 set thread context of 4804 2084 SecuriteInfo.com.Win32.Malware-gen.21488.exe cvtres.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

cvtres.exepowershell.exe

pid process

4804 cvtres.exe
4804 cvtres.exe
4956 powershell.exe
4956 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cvtres.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4804 cvtres.exe
Token: SeDebugPrivilege 4956 powershell.exe

description	pid	process	target process
PID 2084 set thread context of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe

description	pid	process
Token: SeDebugPrivilege	4804	cvtres.exe
Token: SeDebugPrivilege	4956	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

SecuriteInfo.com.Win32.Malware-gen.21488.execvtres.execmd.exe

description	pid	process	target process
PID 2084 wrote to memory of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe
PID 2084 wrote to memory of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe
PID 2084 wrote to memory of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe
PID 2084 wrote to memory of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe
PID 2084 wrote to memory of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe
PID 2084 wrote to memory of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe
PID 2084 wrote to memory of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe
PID 2084 wrote to memory of 4804	2084	SecuriteInfo.com.Win32.Malware-gen.21488.exe	cvtres.exe
PID 4804 wrote to memory of 3600	4804	cvtres.exe	cmd.exe
PID 4804 wrote to memory of 3600	4804	cvtres.exe	cmd.exe
PID 4804 wrote to memory of 3600	4804	cvtres.exe	cmd.exe
PID 3600 wrote to memory of 4956	3600	cmd.exe	powershell.exe
PID 3600 wrote to memory of 4956	3600	cmd.exe	powershell.exe
PID 3600 wrote to memory of 4956	3600	cmd.exe	powershell.exe

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:3600

memory/2084-132-0x0000000000820000-0x00000000008BC000-memory.dmp

Filesize
624KB

Download
memory/3600-138-0x0000000000000000-mapping.dmp

Download
memory/4804-133-0x0000000000000000-mapping.dmp

Download
memory/4804-134-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4804-135-0x00000000055C0000-0x0000000005652000-memory.dmp

Filesize
584KB

Download
memory/4804-136-0x0000000005C10000-0x00000000061B4000-memory.dmp

Filesize
5.6MB

Download
memory/4804-137-0x0000000005660000-0x00000000056C6000-memory.dmp

Filesize
408KB

Download
memory/4956-140-0x0000000005160000-0x0000000005196000-memory.dmp

Filesize
216KB

Download
memory/4956-139-0x0000000000000000-mapping.dmp

Download
memory/4956-141-0x0000000005900000-0x0000000005F28000-memory.dmp

Filesize
6.2MB

Download
memory/4956-142-0x0000000005870000-0x0000000005892000-memory.dmp

Filesize
136KB

Download
memory/4956-143-0x0000000006060000-0x00000000060C6000-memory.dmp

Filesize
408KB

Download
memory/4956-144-0x0000000006740000-0x000000000675E000-memory.dmp

Filesize
120KB

Download
memory/4956-145-0x0000000007F70000-0x00000000085EA000-memory.dmp

Filesize
6.5MB

Download
memory/4956-146-0x0000000006C50000-0x0000000006C6A000-memory.dmp

Filesize
104KB

Download
memory/4956-147-0x0000000007990000-0x0000000007A26000-memory.dmp

Filesize
600KB

Download
memory/4956-148-0x00000000078F0000-0x0000000007912000-memory.dmp

Filesize
136KB

Download