m00nd3v_logger | 71ba0f2207724fdcd6ae946c22683e8208ea2da4ef1d0026f08966eaeaf39d1f

General

Target

8875ae2d57289e7589027bd085c7c17a.exe
Size

699KB
MD5

8875ae2d57289e7589027bd085c7c17a
SHA1

8ef58bda3235b6cac0dce3f977d194c0d33cb694
SHA256

71ba0f2207724fdcd6ae946c22683e8208ea2da4ef1d0026f08966eaeaf39d1f
SHA512

31a00a7fe10cbb922605289403b90f5bdd35520780742141957085f17ab6ef06eb81611624dbbc59bb44c6933faa6e1a48de5e9a8fd3ed6ed7b871f58c8d086b
SSDEEP

12288:cE10Gk3EFpjUa+LVRsb2UsJ4BhBrZ4PhPNAwI6SKkYcjoYkjIGuD8G1VygfW7Ex:cwUUraVgsJ4B3QAJkkYc0JMGu1vKU

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 5 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/1596-17-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/1596-21-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/1596-19-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/1596-11-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/1596-8-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1596-17-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/1596-21-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/1596-19-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/1596-11-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/1596-8-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1596-17-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/1596-21-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/1596-19-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/1596-11-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/1596-8-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

resource	yara_rule
behavioral1/memory/1596-17-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/1596-21-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/1596-19-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/1596-11-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/1596-8-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	8875ae2d57289e7589027bd085c7c17a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29
PID 1872 wrote to memory of 1596	1872	8875ae2d57289e7589027bd085c7c17a.exe	29

C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a.exe
"C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a.exe
  "C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a.exe"
  2⤵
  PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-24-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1596-11-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1596-23-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1596-6-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1596-4-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1596-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1596-21-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1596-25-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1596-28-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1596-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1596-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1596-19-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1872-3-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-1-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-26-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-2-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-22-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-0-0x0000000074371000-0x0000000074372000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing