masslogger | 497087d32c29854c429e0e50006f3a2a47329bb5586615353c0b0f25f9a54a57

General

Target

8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
Size

1.0MB
MD5

8695e39a22c2ea56da6dba4c7c07e32b
SHA1

25f45efbce2d0657b5972e571916ef13633fccef
SHA256

497087d32c29854c429e0e50006f3a2a47329bb5586615353c0b0f25f9a54a57
SHA512

816e2e1b5acbb79f408d52fdcbd1739b4d263e27d539fc930568668b38d04935c5573637eead5ab82bd92d326660cd906a27637e65306a0b1b5ef067d777d4c9
SSDEEP

24576:8SW6SIhZbWsv+6szFB8hxeNtRmuGcmzRT7DXc:89aMfHDYvfzJXc

Score

10^/10

masslogger spyware stealer upx

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3020-15-0x0000000001DE0000-0x0000000001E66000-memory.dmp	family_masslogger
behavioral1/memory/3020-16-0x0000000000400000-0x000000000051E000-memory.dmp	family_masslogger
behavioral1/memory/3020-14-0x0000000001DE0000-0x0000000001E66000-memory.dmp	family_masslogger
behavioral1/memory/3020-11-0x0000000000400000-0x000000000051E000-memory.dmp	family_masslogger
behavioral1/memory/3020-10-0x0000000000400000-0x000000000051E000-memory.dmp	family_masslogger
behavioral1/memory/3020-31-0x00000000761B0000-0x00000000762C0000-memory.dmp	family_masslogger
behavioral1/memory/3020-44-0x0000000000400000-0x000000000051E000-memory.dmp	family_masslogger

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

2484 powershell.exe
Drops startup file 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\totototototot.vbs notepad.exe

pid	process
2484	powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\totototototot.vbs	notepad.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3020-6-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3020-16-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3020-11-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3020-10-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3020-9-0x0000000000400000-0x000000000051E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe

description	pid	process	target process
PID 2992 set thread context of 3020	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exepowershell.exe

pid	process
2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
3020	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
3020	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
2484	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe

pid process

2992 8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3020 8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
Token: SeDebugPrivilege 2484 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3020	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
Token: SeDebugPrivilege	2484	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe

description	pid	process	target process
PID 2992 wrote to memory of 2744	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	notepad.exe
PID 2992 wrote to memory of 2744	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	notepad.exe
PID 2992 wrote to memory of 2744	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	notepad.exe
PID 2992 wrote to memory of 2744	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	notepad.exe
PID 2992 wrote to memory of 2744	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	notepad.exe
PID 2992 wrote to memory of 2744	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	notepad.exe
PID 2992 wrote to memory of 3020	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
PID 2992 wrote to memory of 3020	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
PID 2992 wrote to memory of 3020	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
PID 2992 wrote to memory of 3020	2992	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
PID 3020 wrote to memory of 2484	3020	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	powershell.exe
PID 3020 wrote to memory of 2484	3020	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	powershell.exe
PID 3020 wrote to memory of 2484	3020	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	powershell.exe
PID 3020 wrote to memory of 2484	3020	8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\8695e39a22c2ea56da6dba4c7c07e32b_JaffaCakes118.exe'
    3⤵
    - Deletes itself
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-12-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2744-4-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2992-2-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2992-1-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2992-3-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2992-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2992-7-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/3020-29-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-37-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-16-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3020-11-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3020-10-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3020-15-0x0000000001DE0000-0x0000000001E66000-memory.dmp

Filesize
536KB

Download
memory/3020-9-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3020-28-0x00000000761C1000-0x00000000761C2000-memory.dmp

Filesize
4KB

Download
memory/3020-30-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-6-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3020-31-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-34-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-33-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-14-0x0000000001DE0000-0x0000000001E66000-memory.dmp

Filesize
536KB

Download
memory/3020-36-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-35-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-32-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-38-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-43-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-42-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-41-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-40-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-39-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-44-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3020-46-0x00000000761B0000-0x00000000762C0000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads