m00nd3v_logger | 91cf31cdc2fe3bca0af7b933e77febf1eebf665d91d99a1e5b8deb373a854114

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
Size

649KB
MD5

a16e3f785428ebb2d4aabe6c496f3e79
SHA1

f25c0528e226668c56bb7ca3e40417208e3d4917
SHA256

91cf31cdc2fe3bca0af7b933e77febf1eebf665d91d99a1e5b8deb373a854114
SHA512

32b3eb95102fafb8e00286387d90a2b499b948fc445601a9557d2426658d68f917804f580b3b9f9fc2eb68263698c860ce808b52f0da44783c8c64511dc2f310
SSDEEP

12288:J0frWjPL+ptawf36zU6puXdL6b60yOrTGXzXRWo71rKgU0oVD:JsWbLAoiqI6pQdL6G0JCjXMD

Score

10^/10

m00nd3v_logger infostealer spyware stealer

Malware Config

Signatures

M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 3 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger
behavioral1/memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView
behavioral1/memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView
behavioral1/memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft
behavioral1/memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp	Nirsoft

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 bot.whatismyipaddress.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

description pid process target process

PID 2940 set thread context of 1580 2940 a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

flow	ioc
4	bot.whatismyipaddress.com

description	pid	process	target process
PID 2940 set thread context of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

Processes:

a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

pid process

2940 a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2940 a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

pid	process
2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

description	pid	process	target process
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
PID 2940 wrote to memory of 1580	2940	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe	a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940

C:\Users\Admin\AppData\Local\Temp\a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a16e3f785428ebb2d4aabe6c496f3e79_JaffaCakes118.exe"
2⤵
PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-11-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1580-10-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1580-20-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1580-13-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1580-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1580-12-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1580-6-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2940-1-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-5-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-0-0x0000000074761000-0x0000000074762000-memory.dmp

Filesize
4KB

Download
memory/2940-4-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-3-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-18-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-2-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download