Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 08:29
General
- Target _71829f75b01941def1951cd3aa880d0f5e779cebf6d5737d24fe3a93705a7d22.js
- Size 1.6MB
- Sample260622-kd18aaav2k
- SHA256 71829f75b01941def1951cd3aa880d0f5e779cebf6d5737d24fe3a93705a7d22
Malware Config
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
00-00-0000
-
host_password
lrO[2rNp6FY|IC7j
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.spacaex.com
-
ssl_slate
True
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\_71829f75b01941def1951cd3aa880d0f5e779cebf6d5737d24fe3a93705a7d22.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -WindowStyle Hidden -W h -NOp -nOni -Command "&([scriptblock]::Create($env:tFkWHzxtWe91rX))"2⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -W h -NOp -nOni -Command &([scriptblock]::Create($env:tFkWHzxtWe91rX))3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Registers new Windows logon scripts automatically executed at logon.
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2836-0-0x00007FFB241BF000-0x00007FFB241C0000-memory.dmp
memory/2836-1-0x000002787F090000-0x000002787F0B2000-memory.dmp
memory/2836-4-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-5-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-6-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-7-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-8-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-9-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-10-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-11-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-12-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-13-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-15-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-16-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-18-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-19-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-17-0x0000027800000000-0x0000027800012000-memory.dmp
memory/2836-14-0x0000027864600000-0x000002786465C000-memory.dmp
memory/2836-20-0x0000027800870000-0x000002780088E000-memory.dmp
memory/2836-21-0x00000278646B0000-0x0000027864700000-memory.dmp
memory/2836-22-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-23-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-24-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-25-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-26-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-27-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-28-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-29-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-30-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-32-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-31-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-33-0x00007FFB24030000-0x00007FFB249D4000-memory.dmp
memory/2836-35-0x000002787F9F0000-0x000002787FBB2000-memory.dmp