m00nd3v_logger | 64227043d81f041fa7786eadd3761e72019c7961e1205888ba522e8caccf8cf6

General

Target

06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe
Size

642KB
MD5

06968b327caf1ec29a719577d53c7d79
SHA1

3cd5d929287221e05d964c6eb309dc1407289961
SHA256

64227043d81f041fa7786eadd3761e72019c7961e1205888ba522e8caccf8cf6
SHA512

04663b6dd898ed475f2721289372a18b77ab4b490e06da5db1695b524b03eebb54fce40514494c7a0cc8c7d74af2600fccba596b1ca2e0d5cae659343c5bd4eb
SSDEEP

12288:0AwBgQyyc5UeN9YcPUuCq+4hG4jLgZFtJApk/dJjFE:0Yyc5Ue9HP3fE4jLgFtaadZm

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 5 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/2492-10-0x0000000000200000-0x000000000028E000-memory.dmp	m00nd3v_logger
behavioral1/memory/2492-15-0x0000000000200000-0x000000000028E000-memory.dmp	m00nd3v_logger
behavioral1/memory/2492-17-0x0000000000200000-0x000000000028E000-memory.dmp	m00nd3v_logger
behavioral1/memory/2492-9-0x0000000000200000-0x000000000028E000-memory.dmp	m00nd3v_logger
behavioral1/memory/2492-19-0x00000000020F0000-0x0000000002130000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2492-10-0x0000000000200000-0x000000000028E000-memory.dmp	MailPassView
behavioral1/memory/2492-15-0x0000000000200000-0x000000000028E000-memory.dmp	MailPassView
behavioral1/memory/2492-17-0x0000000000200000-0x000000000028E000-memory.dmp	MailPassView
behavioral1/memory/2492-9-0x0000000000200000-0x000000000028E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2492-10-0x0000000000200000-0x000000000028E000-memory.dmp	WebBrowserPassView
behavioral1/memory/2492-15-0x0000000000200000-0x000000000028E000-memory.dmp	WebBrowserPassView
behavioral1/memory/2492-17-0x0000000000200000-0x000000000028E000-memory.dmp	WebBrowserPassView
behavioral1/memory/2492-9-0x0000000000200000-0x000000000028E000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral1/memory/2492-10-0x0000000000200000-0x000000000028E000-memory.dmp	Nirsoft
behavioral1/memory/2492-15-0x0000000000200000-0x000000000028E000-memory.dmp	Nirsoft
behavioral1/memory/2492-17-0x0000000000200000-0x000000000028E000-memory.dmp	Nirsoft
behavioral1/memory/2492-9-0x0000000000200000-0x000000000028E000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1624 set thread context of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2492	1624	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe"
  2⤵
  PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-21-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/1624-1-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/1624-2-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/1624-3-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/1624-4-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/1624-5-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/1624-6-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/1624-7-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/1624-0-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/2492-10-0x0000000000200000-0x000000000028E000-memory.dmp

Filesize
568KB

Download
memory/2492-17-0x0000000000200000-0x000000000028E000-memory.dmp

Filesize
568KB

Download
memory/2492-9-0x0000000000200000-0x000000000028E000-memory.dmp

Filesize
568KB

Download
memory/2492-18-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/2492-19-0x00000000020F0000-0x0000000002130000-memory.dmp

Filesize
256KB

Download
memory/2492-20-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download
memory/2492-15-0x0000000000200000-0x000000000028E000-memory.dmp

Filesize
568KB

Download
memory/2492-23-0x0000000074950000-0x0000000074EFB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing