m00nd3v_logger | 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f

General

Target

2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
Size

823KB
MD5

65510e95f239192ac363a192203c1d2c
SHA1

1f35acbc9389e21cfd77cc74f4b633d77b0c732d
SHA256

2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f
SHA512

9c801085ad441790e8cb761fac082ba69fcb7fb47ee67773029072fd37c20c24214dc8a824a346d181cf0dec486dc4fc61162a0373e17e4ca90c5670f1316558
SSDEEP

12288:d0ueVG7/ksXLRittWVAChSaglFAk+JFuLRGzD8PjDLAvJ9e9g0EjslPYHD+e8Rx+:3eE4skttWVAJayHLoDC/ABFaNYj1

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 3 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/files/0x00080000000231f1-5.dat	m00nd3v_logger
behavioral2/files/0x00080000000231f1-11.dat	m00nd3v_logger
behavioral2/files/0x00080000000231f1-12.dat	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/files/0x00080000000231f1-5.dat	MailPassView
behavioral2/files/0x00080000000231f1-11.dat	MailPassView
behavioral2/files/0x00080000000231f1-12.dat	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x00080000000231f1-5.dat	WebBrowserPassView
behavioral2/files/0x00080000000231f1-11.dat	WebBrowserPassView
behavioral2/files/0x00080000000231f1-12.dat	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231f1-5.dat	Nirsoft
behavioral2/files/0x00080000000231f1-11.dat	Nirsoft
behavioral2/files/0x00080000000231f1-12.dat	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe

Executes dropped EXE 1 IoCs

pid	Process
5080	0ri.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
640	javaw.exe
4312	java.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 5080	2376	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	83
PID 2376 wrote to memory of 5080	2376	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	83
PID 2376 wrote to memory of 5080	2376	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	83
PID 2376 wrote to memory of 640	2376	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	85
PID 2376 wrote to memory of 640	2376	2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe	85
PID 640 wrote to memory of 4312	640	javaw.exe	86
PID 640 wrote to memory of 4312	640	javaw.exe	86

C:\Users\Admin\AppData\Local\Temp\2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
"C:\Users\Admin\AppData\Local\Temp\2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\0ri.exe
  "C:\Users\Admin\AppData\Local\Temp\0ri.exe"
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\ori.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Program Files\Java\jre1.8.0_66\bin\java.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.6778794467233432716582897421003962.class
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
3201162338eb6fb87164a8e34f39183c

SHA1
b8a47bce762a4a1f03271f90846152c44b8146a5

SHA256
cd28a340a3a85d47840cde4de812362c40bd95c8b39d2e728e3bb244c5355819

SHA512
700b009009f056c946bb7f8383af8626fd6acbbc060f3c63d58e1542a6a1c5ed3f5c984e94a64cf501513adcbd2b805c935a3ccc208e6c73f64824a1b3034752

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ri.exe

Filesize
547KB

MD5
99ee31a1e534fed7a4cba5787376cd3f

SHA1
8fb763a11511684a347b4640f94e59e19d3eea68

SHA256
290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5

SHA512
77fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.6778794467233432716582897421003962.class

Filesize
241KB

MD5
781fb531354d6f291f1ccab48da6d39f

SHA1
9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

SHA256
97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

SHA512
3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ori.jar

Filesize
479KB

MD5
6a8979d38cd1d99c33eaa74aa7775143

SHA1
efa1b842a8c66c2800e870f090eaeddca0bacdb6

SHA256
50fb5acf95563164b7c3e5a922641cfefbfec4abb6d31439dc69fba075ca4b56

SHA512
4e529d575800446246c7011c907c5dd7169892680d3a8fc126b22d0996e6a1819e013da41133090bc1f287d4358b059d3d5f1c48f57d02a0a148cdd0e0150acb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3027552071-446050021-1254071215-1000\83aa4cc77f591dfc2374580bbd95f6ba_87d750a5-3031-4fa3-b099-3164d7f4f528

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
memory/640-61-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/640-56-0x0000000002DF0000-0x0000000003DF0000-memory.dmp

Filesize
16.0MB

Download
memory/640-27-0x0000000002DF0000-0x0000000003DF0000-memory.dmp

Filesize
16.0MB

Download
memory/640-31-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/640-80-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/640-40-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/640-78-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/640-58-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/2376-0-0x0000000000400000-0x00000000004CF778-memory.dmp

Filesize
829KB

Download
memory/2376-14-0x0000000000400000-0x00000000004CF778-memory.dmp

Filesize
829KB

Download
memory/4312-42-0x0000000003150000-0x0000000004150000-memory.dmp

Filesize
16.0MB

Download
memory/4312-49-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/4312-82-0x0000000003150000-0x0000000004150000-memory.dmp

Filesize
16.0MB

Download
memory/4312-88-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/4312-97-0x0000000003150000-0x0000000004150000-memory.dmp

Filesize
16.0MB

Download
memory/4312-105-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/5080-20-0x0000000001190000-0x00000000011A0000-memory.dmp

Filesize
64KB

Download
memory/5080-19-0x0000000073C10000-0x00000000741C1000-memory.dmp

Filesize
5.7MB

Download
memory/5080-18-0x0000000073C10000-0x00000000741C1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing