Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 02:17
General
- Target Cargo_Loading_Photos_CONT-MSKU123456.js
- Size 2.5MB
- Sample260708-cqv8sshv4v
- SHA256 1aa11a88ef3b708d33f70ae93ccc95acab88939193bc28c6856a3f1405a3ae89
Malware Config
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
00-00-0000
-
host_password
ManMadD#147
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.satishtoy.com
-
ssl_slate
True
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Detects DonutLoader 2 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Cargo_Loading_Photos_CONT-MSKU123456.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MCALWTWQCQRSRUOH.PIF"C:\Users\Admin\Documents\MCALWTWQCQRSRUOH.PIF" C:\Users\Admin\Documents\MCALWTWQCQRSRUOH.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MCALWTWQCQRSRUOH.PIF
MCALWTWQCQRSRUOH.ttf
memory/3860-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-9-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-15-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-14-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-16-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-51-0x00000000147E0000-0x00000000147FF000-memory.dmp
memory/3860-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3860-50-0x00000000147E0000-0x00000000157E0000-memory.dmp
memory/3860-52-0x00007FFB478EF000-0x00007FFB478F0000-memory.dmp
memory/3860-53-0x00007FFB47760000-0x00007FFB48104000-memory.dmp
memory/3860-54-0x0000000026720000-0x000000002673E000-memory.dmp
memory/3860-55-0x00007FFB47760000-0x00007FFB48104000-memory.dmp
memory/3860-56-0x00007FFB47760000-0x00007FFB48104000-memory.dmp
memory/3860-57-0x00007FFB47760000-0x00007FFB48104000-memory.dmp
memory/3860-58-0x00000000267A0000-0x00000000267F0000-memory.dmp
memory/3860-59-0x00007FFB47760000-0x00007FFB48104000-memory.dmp
memory/3860-60-0x0000000028160000-0x0000000028322000-memory.dmp
memory/3860-61-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3860-62-0x00007FFB47760000-0x00007FFB48104000-memory.dmp