m00nd3v_logger | 8495a121d355b93c904be2a9b63831382e9e1406759d5c5e6e8b196a93c79422

General

Target

ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe
Size

1.8MB
MD5

ab378a9483a51f89fe59858d6ad7e3c9
SHA1

07d9c1f0f199c646a6993132128ca89aafdc9b9f
SHA256

8495a121d355b93c904be2a9b63831382e9e1406759d5c5e6e8b196a93c79422
SHA512

8b16454c59e2a655fe604f8d757b95a797b9e3a8058fb2c09f1b6e42ffcd316bbc947060351d6b65802df3f72e2eed88ff57cbf270d2875b882e5600a0aec7f3
SSDEEP

49152:+EaPGAeyuI2+ju5jLYudvacbSKR1aqOJ1m44G2DDL7MnRRtjMbQggto5IU618kI5:+EsB2+s3d

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/2136-59-0x0000000000760000-0x00000000007F0000-memory.dmp	m00nd3v_logger

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbc.url	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2780	2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2780	2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2780	2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2780	2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2780	2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2780	2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2780	2136	ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab378a9483a51f89fe59858d6ad7e3c9_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/2136-1-0x0000000001060000-0x000000000123E000-memory.dmp

Filesize
1.9MB

Download
memory/2136-2-0x0000000000F30000-0x0000000000FE4000-memory.dmp

Filesize
720KB

Download
memory/2136-3-0x0000000000200000-0x0000000000226000-memory.dmp

Filesize
152KB

Download
memory/2136-6-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2136-7-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-8-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-20-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-48-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-10-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-14-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-18-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-24-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-30-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-58-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-56-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-54-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-52-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-50-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-46-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-44-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-42-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-40-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-38-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-36-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-34-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-32-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-28-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-26-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-22-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-16-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-12-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/2136-59-0x0000000000760000-0x00000000007F0000-memory.dmp

Filesize
576KB

Download
memory/2136-60-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2136-61-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing