m00nd3v_logger | 64227043d81f041fa7786eadd3761e72019c7961e1205888ba522e8caccf8cf6

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe
Size

642KB
MD5

06968b327caf1ec29a719577d53c7d79
SHA1

3cd5d929287221e05d964c6eb309dc1407289961
SHA256

64227043d81f041fa7786eadd3761e72019c7961e1205888ba522e8caccf8cf6
SHA512

04663b6dd898ed475f2721289372a18b77ab4b490e06da5db1695b524b03eebb54fce40514494c7a0cc8c7d74af2600fccba596b1ca2e0d5cae659343c5bd4eb
SSDEEP

12288:0AwBgQyyc5UeN9YcPUuCq+4hG4jLgZFtJApk/dJjFE:0Yyc5Ue9HP3fE4jLgFtaadZm

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/2192-8-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2192-8-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2192-8-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/memory/2192-8-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4868 set thread context of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85
PID 4868 wrote to memory of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85
PID 4868 wrote to memory of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85
PID 4868 wrote to memory of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85
PID 4868 wrote to memory of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85
PID 4868 wrote to memory of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85
PID 4868 wrote to memory of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85
PID 4868 wrote to memory of 2192	4868	06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe"
  2⤵
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\06968b327caf1ec29a719577d53c7d79_JaffaCakes118.exe.log

Filesize
518B

MD5
6f7d75899d5427a4ada7a840a7a04d5c

SHA1
99eb2c39ba43c7e65dc798fe8b52c53de03816ea

SHA256
a027cb814313e8be32f1be8b9d39bb0ba03263c6fde02e6b8ee69e5b925db67e

SHA512
4ed2f02a9966ef1511399770fbfa2a06700fe184d365284d9031041bb641cf55717797c6935e8d192620961e49cca8ad24a96cc0af883ee9b7733940f5356a24

Download Submit
memory/2192-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2192-16-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/2192-14-0x0000000001640000-0x0000000001650000-memory.dmp

Filesize
64KB

Download
memory/2192-10-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/2192-9-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/4868-3-0x00000000017F0000-0x0000000001800000-memory.dmp

Filesize
64KB

Download
memory/4868-7-0x00000000017F0000-0x0000000001800000-memory.dmp

Filesize
64KB

Download
memory/4868-6-0x00000000017F0000-0x0000000001800000-memory.dmp

Filesize
64KB

Download
memory/4868-5-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/4868-4-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/4868-12-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/4868-0-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/4868-2-0x00000000017F0000-0x0000000001800000-memory.dmp

Filesize
64KB

Download
memory/4868-1-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download