Analysis
- max time kernel
139s - max time network
107s - platform
windows11-21h2_x64 - resource
win11-20250410-en - resource tags
- submitted
19/04/2025, 09:40
General
- Target Invoice.com.exe
- Size 1.2MB
- Sample250419-lnempsvlw9
- SHA256 2d49d19147bf73fe690b7f927c622f15aebd9afd1990be6c5754e0833f341d79
Malware Config
Extracted
-
masslogger
-
https://api.telegram.org/bot8136617573:AAGlljZMQ8u9tcHA-LI---FUDMJzNiMdY-c/sendMessage?chat_id=8099938407
-
exfiltration_mode
#TGEnabled
-
expire_time_date
2025-05-08
-
ssl_slate
False
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Masslogger family
- Drops startup file 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice.com.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.com.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1188-1351-0x00000000743C0000-0x0000000074B71000-memory.dmp
memory/1188-1352-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1188-1353-0x0000000005800000-0x000000000589C000-memory.dmp
memory/1188-1354-0x00000000743C0000-0x0000000074B71000-memory.dmp
memory/1188-1355-0x00000000068C0000-0x0000000006910000-memory.dmp
memory/1188-1358-0x00000000743C0000-0x0000000074B71000-memory.dmp
memory/1188-1357-0x0000000006A30000-0x0000000006A3A000-memory.dmp
memory/1188-1356-0x0000000006BE0000-0x0000000006DA2000-memory.dmp
memory/2572-39-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-27-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-5-0x0000000004F90000-0x0000000005022000-memory.dmp
memory/2572-19-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-23-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-61-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-69-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-67-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-65-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-63-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-59-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-57-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-55-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-51-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-49-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-47-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-43-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-41-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-3-0x00000000743C0000-0x0000000074B71000-memory.dmp
memory/2572-37-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-35-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-31-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-30-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-4-0x0000000005490000-0x0000000005A36000-memory.dmp
memory/2572-25-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-21-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-17-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-15-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-13-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-53-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-45-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-9-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-33-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-7-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-11-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-6-0x0000000004D70000-0x0000000004E71000-memory.dmp
memory/2572-1342-0x00000000743C0000-0x0000000074B71000-memory.dmp
memory/2572-1343-0x0000000005030000-0x000000000508E000-memory.dmp
memory/2572-2-0x0000000004D70000-0x0000000004E76000-memory.dmp
memory/2572-1-0x00000000001F0000-0x0000000000328000-memory.dmp
memory/2572-0-0x00000000743CE000-0x00000000743CF000-memory.dmp
memory/2572-1344-0x00000000050A0000-0x00000000050FC000-memory.dmp
memory/2572-1345-0x0000000005160000-0x00000000051AC000-memory.dmp
memory/2572-1346-0x00000000051D0000-0x0000000005224000-memory.dmp
memory/2572-1350-0x00000000743C0000-0x0000000074B71000-memory.dmp