Analysis
- max time kernel
149s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 18:03
General
- Target invoice1311.pdf.js
- Size 479KB
- Sample261007-wnac4acw9x
- SHA256 4e6d790d647a413608691750eccb12885cd69f6711d13d9df268c12a72b4a5c1
Malware Config
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
00-00-0000
-
host_password
@tf0794888229
-
host_port
587
-
host_receiver
result box: [email protected]
- host_sender
-
host_server
mail.atf-transformer.af
-
ssl_slate
False
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\invoice1311.pdf.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:MUVKX))2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\54776513993222.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\54776513993222.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XCSOIPBEVF))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XCSOIPBEVF))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:XCSOIPBEVF))"4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\54776513993222.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
54776513993222.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bfeyrzba.1lm.psm1
handoff_dbg_2376_e59383d.txt
memory/616-366-0x0000000002A00000-0x0000000002A10000-memory.dmp
memory/616-349-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/616-1154-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/616-1158-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/616-1160-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/616-1207-0x0000000005350000-0x0000000005360000-memory.dmp
memory/616-1213-0x0000000005390000-0x00000000053A0000-memory.dmp
memory/616-1161-0x0000000002900000-0x0000000002910000-memory.dmp
memory/616-1163-0x0000000002920000-0x0000000002930000-memory.dmp
memory/616-1190-0x0000000002B00000-0x0000000002B10000-memory.dmp
memory/616-1091-0x0000000005B40000-0x0000000005B4A000-memory.dmp
memory/616-1090-0x0000000005BC0000-0x0000000005C52000-memory.dmp
memory/616-584-0x0000000005350000-0x0000000005360000-memory.dmp
memory/616-514-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/616-521-0x0000000002920000-0x0000000002930000-memory.dmp
memory/616-532-0x0000000002A00000-0x0000000002A10000-memory.dmp
memory/616-446-0x00000000003B0000-0x00000000003BB000-memory.dmp
memory/616-154-0x0000000054240000-0x0000000054241000-memory.dmp
memory/616-444-0x0000000005CB0000-0x0000000005E72000-memory.dmp
memory/616-427-0x0000000054CC0000-0x0000000054CC1000-memory.dmp
memory/616-431-0x0000000054CE0000-0x0000000054CE1000-memory.dmp
memory/616-403-0x0000000005350000-0x0000000005360000-memory.dmp
memory/616-426-0x0000000054CB0000-0x0000000054CB1000-memory.dmp
memory/616-234-0x0000000002720000-0x0000000002730000-memory.dmp
memory/616-433-0x0000000054CF0000-0x0000000054CF1000-memory.dmp
memory/616-344-0x0000000002710000-0x0000000002720000-memory.dmp
memory/616-367-0x0000000002A20000-0x0000000002A30000-memory.dmp
memory/616-78-0x0000000000400000-0x0000000000420000-memory.dmp
memory/616-359-0x0000000002920000-0x0000000002930000-memory.dmp
memory/616-292-0x0000000000AE0000-0x0000000000AF0000-memory.dmp
memory/616-274-0x00000000053B0000-0x0000000005400000-memory.dmp
memory/616-273-0x0000000004E60000-0x0000000004EFC000-memory.dmp
memory/616-83-0x0000000000550000-0x0000000000552000-memory.dmp
memory/616-55-0x0000000000A00000-0x0000000000A40000-memory.dmp
memory/616-73-0x0000000002540000-0x0000000002560000-memory.dmp
memory/616-71-0x0000000000A00000-0x0000000000A40000-memory.dmp
memory/616-68-0x0000000000A00000-0x0000000000A40000-memory.dmp
memory/616-94-0x0000000000AC0000-0x0000000000AD7000-memory.dmp
memory/616-58-0x0000000010000000-0x0000000010040000-memory.dmp
memory/616-77-0x0000000002880000-0x000000000289E000-memory.dmp
memory/616-156-0x0000000054250000-0x0000000054251000-memory.dmp
memory/616-160-0x00000000576B0000-0x00000000576B1000-memory.dmp
memory/616-124-0x0000000002680000-0x0000000002681000-memory.dmp
memory/616-162-0x00000000576C0000-0x00000000576C1000-memory.dmp
memory/616-146-0x0000000010000000-0x0000000010040000-memory.dmp
memory/616-152-0x0000000054230000-0x0000000054231000-memory.dmp
memory/616-131-0x0000000002720000-0x0000000002730000-memory.dmp
memory/616-123-0x0000000002670000-0x0000000002671000-memory.dmp
memory/616-107-0x0000000002540000-0x0000000002560000-memory.dmp
memory/616-106-0x0000000002540000-0x0000000002560000-memory.dmp
memory/616-102-0x0000000000C70000-0x0000000000C87000-memory.dmp
memory/616-95-0x0000000000AE0000-0x0000000000AF0000-memory.dmp
memory/616-187-0x0000000000AE0000-0x0000000000AF0000-memory.dmp
memory/2376-43-0x0000000070C70000-0x0000000070CBC000-memory.dmp
memory/2376-37-0x00000000073D0000-0x00000000073F2000-memory.dmp
memory/2376-23-0x0000000002DC0000-0x0000000002DF6000-memory.dmp
memory/2376-24-0x00000000055B0000-0x0000000005BFA000-memory.dmp
memory/2376-54-0x0000000008080000-0x0000000008088000-memory.dmp
memory/2376-53-0x0000000008090000-0x00000000080AC000-memory.dmp
memory/2376-52-0x00000000079C0000-0x00000000079D5000-memory.dmp
memory/2376-51-0x00000000079B0000-0x00000000079C0000-memory.dmp
memory/2376-50-0x0000000007980000-0x0000000007991000-memory.dmp
memory/2376-49-0x0000000007820000-0x000000000782A000-memory.dmp
memory/2376-48-0x0000000007720000-0x00000000077C3000-memory.dmp
memory/2376-26-0x0000000005490000-0x00000000054F6000-memory.dmp
memory/2376-47-0x00000000076E0000-0x0000000007700000-memory.dmp
memory/2376-44-0x0000000070E20000-0x000000007117B000-memory.dmp
memory/2376-42-0x00000000076A0000-0x00000000076D6000-memory.dmp
memory/2376-27-0x0000000005500000-0x0000000005566000-memory.dmp
memory/2376-38-0x0000000008620000-0x0000000008BDA000-memory.dmp
memory/2376-35-0x0000000007360000-0x000000000737A000-memory.dmp
memory/2376-36-0x0000000007430000-0x00000000074C6000-memory.dmp
memory/2376-34-0x00000000079E0000-0x000000000805C000-memory.dmp
memory/2376-32-0x00000000060E0000-0x000000000612C000-memory.dmp
memory/2376-31-0x00000000060C0000-0x00000000060DE000-memory.dmp
memory/2376-30-0x0000000005C00000-0x0000000005F5B000-memory.dmp
memory/2376-25-0x00000000053F0000-0x0000000005412000-memory.dmp
memory/4148-2-0x00000238C9B60000-0x00000238C9B82000-memory.dmp
memory/4148-0-0x00007FFDC278F000-0x00007FFDC2790000-memory.dmp
memory/4148-1-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp
memory/4148-8-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp
memory/4148-5-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp
memory/4148-6-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp
memory/4148-7-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp
memory/4148-13-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp
memory/4148-12-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp
memory/4148-9-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp