m00nd3v_logger | 71ba0f2207724fdcd6ae946c22683e8208ea2da4ef1d0026f08966eaeaf39d1f

General

Target

8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
Size

699KB
MD5

8875ae2d57289e7589027bd085c7c17a
SHA1

8ef58bda3235b6cac0dce3f977d194c0d33cb694
SHA256

71ba0f2207724fdcd6ae946c22683e8208ea2da4ef1d0026f08966eaeaf39d1f
SHA512

31a00a7fe10cbb922605289403b90f5bdd35520780742141957085f17ab6ef06eb81611624dbbc59bb44c6933faa6e1a48de5e9a8fd3ed6ed7b871f58c8d086b
SSDEEP

12288:cE10Gk3EFpjUa+LVRsb2UsJ4BhBrZ4PhPNAwI6SKkYcjoYkjIGuD8G1VygfW7Ex:cwUUraVgsJ4B3QAJkkYc0JMGu1vKU

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 3 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/1948-3-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral2/memory/1948-5-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral2/memory/1948-4-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/1948-3-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral2/memory/1948-5-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral2/memory/1948-4-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1948-3-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral2/memory/1948-5-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral2/memory/1948-4-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1948-3-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral2/memory/1948-5-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral2/memory/1948-4-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 bot.whatismyipaddress.com

flow	ioc
19	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

description	pid	process	target process
PID 4764 set thread context of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4764 8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

description	pid	process	target process
PID 4764 wrote to memory of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 4764 wrote to memory of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 4764 wrote to memory of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 4764 wrote to memory of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 4764 wrote to memory of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 4764 wrote to memory of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 4764 wrote to memory of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 4764 wrote to memory of 1948	4764	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe"
  2⤵
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe.log

Filesize
400B

MD5
0a9b4592cd49c3c21f6767c2dabda92f

SHA1
f534297527ae5ccc0ecb2221ddeb8e58daeb8b74

SHA256
c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd

SHA512
6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

Download Submit
memory/1948-7-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/1948-3-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1948-5-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1948-4-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1948-8-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/1948-10-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/1948-13-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/1948-15-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4764-2-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4764-0-0x0000000075212000-0x0000000075213000-memory.dmp

Filesize
4KB

Download
memory/4764-11-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4764-1-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads