masslogger | 20aee558373c235c0f542eea64bb53229338457a5e6f5f3bf8ab4b9e4c1d5d64

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orden de compra urgente.js
Size 2.4MB
Sample260820-ryrb5sygld
SHA256 20aee558373c235c0f542eea64bb53229338457a5e6f5f3bf8ab4b9e4c1d5d64
MD5 2a992057a98705fd6bd7485fff5f814c
SHA1 d43db130ca11066c1d3387c85f0a3775332f0628
SHA512 1473eb8c37a80934b980af8500e9f872bf23650f9b92205d3c0dc49dfbd216645f54dfd3f3f62de543680b17b0aef9453f468e9170fbcfccf36977ca71ab2ed1
SSDEEP 24576:8VUTOEfekRabg6Lx0DtB6Q7ypoHQrEGKA32FrJGj7ktF1Rzloc9o9C911tNLXYm7:HYQAm6EDjAyt
TLSH
T183C5330D4529ED1794D03870960D98912E6D4CCFCF5F85C7BD4E8BFCEA87128286BAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution masslogger persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
prodinsal.com.mx
Port
587
Username
[email protected]
Password
Pr0d1ns@l*25!

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
00-00-0000
host_password
Pr0d1ns@l*25!
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
prodinsal.com.mx
ssl_slate
False

Signatures

Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1812	powershell.exe
4	1812	powershell.exe
7	1812	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1812	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org
1	reallyfreegeoip.org
4	reallyfreegeoip.org

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1812	powershell.exe
1812	powershell.exe
1812	powershell.exe
1812	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5544	conhost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 1996	5544	conhost.exe	93
PID 2460 wrote to memory of 1812	2460	conhost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Orden de compra urgente.js"
1⤵
PID:4232

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2436

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1996

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\131qmt1miruh\131qmt1miruh.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\131qmt1miruh\131qmt1miruh.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

131qmt1miruh.ps1

Path C:\Users\Admin\AppData\Local\Temp\131qmt1miruh\131qmt1miruh.ps1
Size 1KB
SHA256 af16817745f42c850c70bb2c78a7ec412e32f837a4f6d02a695afbc682a3e79c
MD5 daa1ba107881c7c97f1723cd1acc267c
SHA1 d351d995cc75819d032e88af0b16da55c0e85f40
SHA512 aef58529d7108cd7d54bd54f15b13c4127b8672361acd863eeb736a72182ad5dc8e15695a69ce4a35459fb8906d4cd5e6313429fba44038cee5eb037280346af
TLSH
T1B431017123C3D6BA0563C0739D60537CE1A4092DA78CAF95F6A4E109274A4586EF7743
MD5 SHA1 SHA512 TLSH

Submit Download

131qmt1miruha

Path C:\Users\Admin\AppData\Local\Temp\131qmt1miruh\131qmt1miruha
Size 351KB
SHA256 567bbb59cf43b4e636109bf9934f4cbf7f9401d307c973333759c08dac5eff78
MD5 608fd104504f5a24171075967207e7e7
SHA1 7d0873fca8cceff3504ffb1959a311ce412949f9
SHA512 3f94d6ecde07b25cc4169ceb61d9d16527fd13e48d15db2ff8b0747bcd25b2937de33ff0fdb9fec9dd784bbd75411fc6c5d0140bc2fa5e951c11f0453b10801b
SSDEEP 6144:Rm3b+BzPPNDde8PKogJGuqUKf4MXqCYK/St7RVY5ZX2vYrUcFZUHEv0Yutcaspfx:Rk69eoLuY4M6K/OMNIWMEv0xcas
TLSH
T1887423C10F7B0D7935BCB11E84EEA58D6772E789B89ED086A2507CF94139A0ECD1768C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

131qmt1miruhb

Path C:\Users\Admin\AppData\Local\Temp\131qmt1miruh\131qmt1miruhb
Size 351KB
SHA256 2f7f90f4cee8a81e5f6798ecc9378485ae5245e9fee3b8970eac4e444fa993f7
MD5 27762dd5833ce700c385e2c9420edcd2
SHA1 0db104c75aee0fa6a09e4fcc4dcd209890065728
SHA512 7222ef58004772fc403d7e6a12c922d57dbc921ae626f3653d08b2365524b816ab4351980b6c789a9a337d11aff5cab1a892829ff0b431109002efdbffaf4a6e
SSDEEP 6144:wBgRlTqN4/V5yLwweuPBIMVHZDfxHx+Iq3zDsoKHt:w6lmN4eLwwpHVpHj0zgo0t
TLSH
T1C2742313ED3C3CEA0E2867CA11AF6C66B170B7128449DB5B17BC8CE2475B25E8E36457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-5-0x000002E5A57C0000-0x000002E5A57E2000-memory.dmp

Download

memory/1812-9-0x000002E5A5A70000-0x000002E5A5C16000-memory.dmp

Download

memory/1812-10-0x000002E5A5C20000-0x000002E5A5C76000-memory.dmp

Download

memory/1812-11-0x000002E5A5C80000-0x000002E5A5C9E000-memory.dmp

Download

memory/1812-13-0x000002E5A5E40000-0x000002E5A5E90000-memory.dmp

Download

memory/1812-14-0x000002E5A6060000-0x000002E5A6222000-memory.dmp

Download