m00nd3v_logger | 91cf31cdc2fe3bca0af7b933e77febf1eebf665d91d99a1e5b8deb373a854114

General

Target

a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
Size

649KB
MD5

a16e3f785428ebb2d4aabe6c496f3e79
SHA1

f25c0528e226668c56bb7ca3e40417208e3d4917
SHA256

91cf31cdc2fe3bca0af7b933e77febf1eebf665d91d99a1e5b8deb373a854114
SHA512

32b3eb95102fafb8e00286387d90a2b499b948fc445601a9557d2426658d68f917804f580b3b9f9fc2eb68263698c860ce808b52f0da44783c8c64511dc2f310
SSDEEP

12288:J0frWjPL+ptawf36zU6puXdL6b60yOrTGXzXRWo71rKgU0oVD:JsWbLAoiqI6pQdL6G0JCjXMD

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 3 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral1/memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe"
  2⤵
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-11-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1580-20-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1580-13-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1580-12-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2940-1-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-5-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-0-0x0000000074761000-0x0000000074762000-memory.dmp

Filesize
4KB

Download
memory/2940-4-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-3-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-18-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-2-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing