masslogger | f487db26e46dc5067bca06003759d119dae50ff6c527a8c68fc01d73f41f4a64

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe
Size

1.2MB
MD5

93691c5a4445ff293229299f17d4c1f9
SHA1

d35793248343061d6b01718838de0023e8b20295
SHA256

f487db26e46dc5067bca06003759d119dae50ff6c527a8c68fc01d73f41f4a64
SHA512

a6bfd4e26771ad0e38ff20052cf9f3535185e4ec60d162a3c143f178ae679b55ff4d93b82a2b8e3a01937db4243af235d142ba9465288e34a79efc15b047b1e9
SSDEEP

24576:UL+Mb7hUhZqc0jcZMrmQQDWBmbcLe3Pz3BUxPk+prSDVxHgVwX:UfWh10QZSIW0bcqjW+oSDVxHKU

Score

10^/10

masslogger spyware stealer upx

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main payload 37 IoCs

resource	yara_rule
behavioral1/memory/2964-10-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-11-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-9-0x0000000000400000-0x0000000000568000-memory.dmp	family_masslogger
behavioral1/memory/2964-8-0x0000000000400000-0x0000000000568000-memory.dmp	family_masslogger
behavioral1/memory/2964-7-0x0000000000400000-0x0000000000568000-memory.dmp	family_masslogger
behavioral1/memory/2964-23-0x0000000000400000-0x0000000000568000-memory.dmp	family_masslogger
behavioral1/memory/2964-22-0x0000000000400000-0x0000000000568000-memory.dmp	family_masslogger
behavioral1/memory/2964-24-0x0000000000400000-0x0000000000568000-memory.dmp	family_masslogger
behavioral1/memory/2964-26-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-30-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-34-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-40-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-46-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-48-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-44-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-42-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-38-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-36-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-32-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-28-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-54-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-68-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-66-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-64-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-62-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-60-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-58-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-56-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-72-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-52-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-50-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-80-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-78-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-76-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-74-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-70-0x0000000001E90000-0x0000000001F38000-memory.dmp	family_masslogger
behavioral1/memory/2964-533-0x0000000000400000-0x0000000000568000-memory.dmp	family_masslogger

Deletes itself 1 IoCs

pid	Process
3424	powershell.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2964-3-0x0000000000400000-0x0000000000568000-memory.dmp	upx
behavioral1/memory/2964-6-0x0000000000400000-0x0000000000568000-memory.dmp	upx
behavioral1/memory/2964-9-0x0000000000400000-0x0000000000568000-memory.dmp	upx
behavioral1/memory/2964-8-0x0000000000400000-0x0000000000568000-memory.dmp	upx
behavioral1/memory/2964-7-0x0000000000400000-0x0000000000568000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 2964	1560	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1560	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe
3424	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1560	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe
Token: SeDebugPrivilege	3424	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2964	1560	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	28
PID 1560 wrote to memory of 2964	1560	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	28
PID 1560 wrote to memory of 2964	1560	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	28
PID 1560 wrote to memory of 2964	1560	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	28
PID 2964 wrote to memory of 3388	2964	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	30
PID 2964 wrote to memory of 3388	2964	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	30
PID 2964 wrote to memory of 3388	2964	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	30
PID 2964 wrote to memory of 3388	2964	93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe	30
PID 3388 wrote to memory of 3424	3388	cmd.exe	32
PID 3388 wrote to memory of 3424	3388	cmd.exe	32
PID 3388 wrote to memory of 3424	3388	cmd.exe	32
PID 3388 wrote to memory of 3424	3388	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\93691c5a4445ff293229299f17d4c1f9_JaffaCakes118.exe'
      4⤵
      Deletes itself
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1560-1-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/1560-2-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1560-4-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2964-3-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2964-6-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2964-10-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-11-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-9-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2964-8-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2964-7-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2964-23-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2964-22-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2964-24-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2964-26-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-30-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-34-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-40-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-46-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-48-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-44-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-42-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-38-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-36-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-32-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-28-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-54-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-68-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-66-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-64-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-62-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-60-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-58-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-56-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-72-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-52-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-50-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-80-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-78-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-76-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-74-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-70-0x0000000001E90000-0x0000000001F38000-memory.dmp

Filesize
672KB

Download
memory/2964-533-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download