Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 17:09
General
- Target 489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa.exe
- Size 1.4MB
- Sample260708-vpetjac16j
- SHA256 489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa
Malware Config
Extracted
-
masslogger
-
https://api.telegram.org/bot7433626511:AAG6-SliBdFhddNZipC5HIcTnvhgatm6i28/sendMessage?chat_id=1780630805
-
exfiltration_mode
#TGEnabled
-
expire_time_date
2298-07-03
-
ssl_slate
False
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa.exe"C:\Users\Admin\AppData\Local\Temp\489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\colliquefaction\parterres.exe"C:\Users\Admin\AppData\Local\Temp\489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 7443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5276 -ip 52761⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
parterres.exe
memory/1480-13-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1480-14-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1480-15-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1480-16-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1480-17-0x00000000738C2000-0x00000000738C3000-memory.dmp
memory/1480-18-0x0000000003690000-0x00000000036C0000-memory.dmp
memory/1480-19-0x00000000738B0000-0x000000007406C000-memory.dmp
memory/1480-20-0x00000000738B0000-0x000000007406C000-memory.dmp
memory/1480-22-0x0000000003710000-0x000000000373E000-memory.dmp
memory/1480-21-0x00000000061B0000-0x000000000676A000-memory.dmp
memory/1480-114-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-116-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-142-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-471-0x0000000005BF0000-0x0000000005C8C000-memory.dmp
memory/1480-140-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-138-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-472-0x00000000738B0000-0x000000007406C000-memory.dmp
memory/1480-136-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-134-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-132-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-130-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-126-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-124-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-122-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-120-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-118-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-112-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-111-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-108-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-106-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-104-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-102-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-96-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-94-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-92-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-90-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-88-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-84-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-82-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-80-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-78-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-76-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-74-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-72-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-66-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-64-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-63-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-60-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-58-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-56-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-54-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-52-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-48-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-44-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-40-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-38-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-36-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-34-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-32-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-31-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-28-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-26-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-24-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-23-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-128-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-100-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-98-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-473-0x0000000006BF0000-0x0000000006C40000-memory.dmp
memory/1480-86-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-70-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-68-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-50-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-46-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-42-0x0000000003710000-0x0000000003738000-memory.dmp
memory/1480-474-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1480-475-0x0000000006F10000-0x00000000070D2000-memory.dmp
memory/1480-476-0x0000000006E60000-0x0000000006EF2000-memory.dmp
memory/1480-477-0x0000000006E20000-0x0000000006E2A000-memory.dmp
memory/1480-478-0x00000000738C2000-0x00000000738C3000-memory.dmp
memory/1480-479-0x00000000738B0000-0x000000007406C000-memory.dmp
memory/1480-480-0x00000000738B0000-0x000000007406C000-memory.dmp
memory/3084-2-0x0000000001670000-0x0000000001A70000-memory.dmp
memory/5276-11-0x00000000011D0000-0x00000000015D0000-memory.dmp