m00nd3v_logger | 71ba0f2207724fdcd6ae946c22683e8208ea2da4ef1d0026f08966eaeaf39d1f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
Size

699KB
MD5

8875ae2d57289e7589027bd085c7c17a
SHA1

8ef58bda3235b6cac0dce3f977d194c0d33cb694
SHA256

71ba0f2207724fdcd6ae946c22683e8208ea2da4ef1d0026f08966eaeaf39d1f
SHA512

31a00a7fe10cbb922605289403b90f5bdd35520780742141957085f17ab6ef06eb81611624dbbc59bb44c6933faa6e1a48de5e9a8fd3ed6ed7b871f58c8d086b
SSDEEP

12288:cE10Gk3EFpjUa+LVRsb2UsJ4BhBrZ4PhPNAwI6SKkYcjoYkjIGuD8G1VygfW7Ex:cwUUraVgsJ4B3QAJkkYc0JMGu1vKU

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 5 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/2784-9-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/2784-7-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/2784-11-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/2784-17-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/2784-16-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/2784-9-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/2784-7-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/2784-11-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/2784-17-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/2784-16-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/2784-9-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/2784-7-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/2784-11-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/2784-17-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/2784-16-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2784-9-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/2784-7-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/2784-11-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/2784-17-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/2784-16-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 bot.whatismyipaddress.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

description pid process target process

PID 2860 set thread context of 2784 2860 8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe 8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2860 8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

flow	ioc
4	bot.whatismyipaddress.com

description	pid	process	target process
PID 2860 set thread context of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

description	pid	process	target process
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
PID 2860 wrote to memory of 2784	2860	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe	8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860

C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8875ae2d57289e7589027bd085c7c17a_JaffaCakes118.exe"
2⤵
PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-19-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2784-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2784-21-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2784-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2784-9-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2784-7-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2784-18-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2784-11-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2784-24-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2784-5-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2784-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2784-6-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2860-3-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-1-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-2-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-20-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-22-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-0-0x0000000074481000-0x0000000074482000-memory.dmp

Filesize
4KB

Download