masslogger | 00b8e2f4f20cea62efb3ffaf667f36ca4afaeffd3f7ccc5762d753422503be1e

General

Target

9239826853_awb_20221221_514_20221221.exe
Size

576KB
MD5

a27337fabd21bf9cd0eb1b339109c62c
SHA1

8a4c92e398aacafe78987caefe5bc55f984a41ec
SHA256

00b8e2f4f20cea62efb3ffaf667f36ca4afaeffd3f7ccc5762d753422503be1e
SHA512

09bda15ceb928d57295407187290dbc21f26d08a64a8ab4fe564cabf306b928d42fe50bb554e9efdb59d833cec96a4fe513c588fca7737a274eb9a3b1fa5d0d1
SSDEEP

12288:fglVoI8ntiqXOsZtMgBzsSJ/zaGvkRUPFSUEWqf4sLrK9:6qJMGHlza4FS/X2

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4072-139-0x0000000000400000-0x0000000000494000-memory.dmp	family_masslogger
behavioral2/memory/4072-144-0x0000000000400000-0x0000000000494000-memory.dmp	family_masslogger

Executes dropped EXE 2 IoCs

Processes:

cxfogupuk.execxfogupuk.exe

pid process

3356 cxfogupuk.exe
4072 cxfogupuk.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

cxfogupuk.exe

description pid process target process

PID 3356 set thread context of 4072 3356 cxfogupuk.exe cxfogupuk.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

cxfogupuk.exepowershell.exe

pid process

4072 cxfogupuk.exe
4072 cxfogupuk.exe
2116 powershell.exe
2116 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

cxfogupuk.exe

pid process

3356 cxfogupuk.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cxfogupuk.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4072 cxfogupuk.exe
Token: SeDebugPrivilege 2116 powershell.exe

pid	process
3356	cxfogupuk.exe
4072	cxfogupuk.exe

description	pid	process	target process
PID 3356 set thread context of 4072	3356	cxfogupuk.exe	cxfogupuk.exe

pid	process
4072	cxfogupuk.exe
4072	cxfogupuk.exe
2116	powershell.exe
2116	powershell.exe

pid	process
3356	cxfogupuk.exe

description	pid	process
Token: SeDebugPrivilege	4072	cxfogupuk.exe
Token: SeDebugPrivilege	2116	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

9239826853_awb_20221221_514_20221221.execxfogupuk.execxfogupuk.execmd.exe

description	pid	process	target process
PID 4888 wrote to memory of 3356	4888	9239826853_awb_20221221_514_20221221.exe	cxfogupuk.exe
PID 4888 wrote to memory of 3356	4888	9239826853_awb_20221221_514_20221221.exe	cxfogupuk.exe
PID 4888 wrote to memory of 3356	4888	9239826853_awb_20221221_514_20221221.exe	cxfogupuk.exe
PID 3356 wrote to memory of 4072	3356	cxfogupuk.exe	cxfogupuk.exe
PID 3356 wrote to memory of 4072	3356	cxfogupuk.exe	cxfogupuk.exe
PID 3356 wrote to memory of 4072	3356	cxfogupuk.exe	cxfogupuk.exe
PID 3356 wrote to memory of 4072	3356	cxfogupuk.exe	cxfogupuk.exe
PID 4072 wrote to memory of 3380	4072	cxfogupuk.exe	cmd.exe
PID 4072 wrote to memory of 3380	4072	cxfogupuk.exe	cmd.exe
PID 4072 wrote to memory of 3380	4072	cxfogupuk.exe	cmd.exe
PID 3380 wrote to memory of 2116	3380	cmd.exe	powershell.exe
PID 3380 wrote to memory of 2116	3380	cmd.exe	powershell.exe
PID 3380 wrote to memory of 2116	3380	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\9239826853_awb_20221221_514_20221221.exe
"C:\Users\Admin\AppData\Local\Temp\9239826853_awb_20221221_514_20221221.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888

C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe
"C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe" C:\Users\Admin\AppData\Local\Temp\bamlymvxaz.po
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3356

C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe
"C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe' & exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3380

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bamlymvxaz.po
Filesize
5KB

MD5
cfc7faa259afbcdd25b25faf32a6ff72

SHA1
2ed51569eb86f35e7ef01c6167c30f0327f90e64

SHA256
67bbf3441bf6dd136ebfbfb9d4436dc401058b5f573145a9ea4dcaca68b77ef8

SHA512
c457fbd2b624755277185b11c2824018bb9aabdaeca1cfc0420ec74e8f119a9dc73c31363340fcad2cee906d6b66bc71c203696a23f6f70d399fa96eb1a38c4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe
Filesize
104KB

MD5
cb8090344fbb5f454e495b8c0018f126

SHA1
37b532bbf05c43522c5ae0669440429ffa538c02

SHA256
51c8ee761dffd021a6d87a89ebc7cbca5d868ce227c992ce82102fd1c0345328

SHA512
02fad87643ceb02bae2abd3d58073ad390cfaaaea9ed6c32b0e9723851da0b5021e09339edee54c5c7ecbaf334673bfebbe8452bb0cf30764c75824e456d719b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe
Filesize
104KB

MD5
cb8090344fbb5f454e495b8c0018f126

SHA1
37b532bbf05c43522c5ae0669440429ffa538c02

SHA256
51c8ee761dffd021a6d87a89ebc7cbca5d868ce227c992ce82102fd1c0345328

SHA512
02fad87643ceb02bae2abd3d58073ad390cfaaaea9ed6c32b0e9723851da0b5021e09339edee54c5c7ecbaf334673bfebbe8452bb0cf30764c75824e456d719b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxfogupuk.exe
Filesize
104KB

MD5
cb8090344fbb5f454e495b8c0018f126

SHA1
37b532bbf05c43522c5ae0669440429ffa538c02

SHA256
51c8ee761dffd021a6d87a89ebc7cbca5d868ce227c992ce82102fd1c0345328

SHA512
02fad87643ceb02bae2abd3d58073ad390cfaaaea9ed6c32b0e9723851da0b5021e09339edee54c5c7ecbaf334673bfebbe8452bb0cf30764c75824e456d719b

Download Submit
C:\Users\Admin\AppData\Local\Temp\faajk.m
Filesize
577KB

MD5
3f3e36ecf1d2a40322cdc6e03a91abec

SHA1
e2a2049f42e12bf8294f51932b7ab66d3fe758fd

SHA256
1b16301b40062741d9252f07d7a3c6633fec23a5d57eff6527aeafcdd56d37e1

SHA512
cd7ccc51dca3bb8afde51e3a457c54b98a23ba9483a37d880a7fac625a4f537c3e51230d0e61e87effa298cb2ed30a203ab3c604628972fca92776680468027b

Download Submit
memory/2116-153-0x0000000006FA0000-0x0000000007036000-memory.dmp

Filesize
600KB

Download
memory/2116-154-0x0000000006510000-0x0000000006532000-memory.dmp

Filesize
136KB

Download
memory/2116-149-0x00000000057F0000-0x0000000005856000-memory.dmp

Filesize
408KB

Download
memory/2116-152-0x0000000006430000-0x000000000644A000-memory.dmp

Filesize
104KB

Download
memory/2116-151-0x0000000007580000-0x0000000007BFA000-memory.dmp

Filesize
6.5MB

Download
memory/2116-150-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Filesize
120KB

Download
memory/2116-145-0x0000000000000000-mapping.dmp

Download
memory/2116-146-0x00000000025D0000-0x0000000002606000-memory.dmp

Filesize
216KB

Download
memory/2116-147-0x0000000004FE0000-0x0000000005608000-memory.dmp

Filesize
6.2MB

Download
memory/2116-148-0x0000000004EF0000-0x0000000004F12000-memory.dmp

Filesize
136KB

Download
memory/3356-132-0x0000000000000000-mapping.dmp

Download
memory/3380-143-0x0000000000000000-mapping.dmp

Download
memory/4072-137-0x0000000000000000-mapping.dmp

Download
memory/4072-144-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4072-142-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/4072-141-0x0000000006270000-0x0000000006814000-memory.dmp

Filesize
5.6MB

Download
memory/4072-140-0x0000000005C20000-0x0000000005CB2000-memory.dmp

Filesize
584KB

Download
memory/4072-139-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing