Resubmissions
26/09/2026, 22:37
260926-2j7qpatv8r26/09/2026, 01:02
260926-bd84fs1bnc1026/09/2026, 00:59
260926-bcllrs1y2k1020/09/2026, 10:36
260920-mnczjsab771020/09/2026, 07:07
260920-hx3jcadp5x1008/09/2026, 15:38
260908-s27nzagd9315/08/2026, 21:05
260815-zw6ytat1ez15/08/2026, 20:50
260815-zmxnsatzgs15/08/2026, 20:46
260815-zkklfatcnf15/08/2026, 20:40
260815-zf5e2stcjbAnalysis
- max time kernel
149s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/07/2026, 12:54
General
- Target Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
- Size 782KB
- Sample260712-p5a8dsas8k
- SHA256 a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b
Malware Config
Extracted
-
masslogger
-
https://api.telegram.org/bot7557609045:AAHgxfWXqRPgwr5JAhsZqLlIJvPQkqavC0g/sendMessage?chat_id=671054766
-
exfiltration_mode
#TGEnabled
-
expire_time_date
2025-07-13
-
ssl_slate
False
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe.log
memory/668-6-0x0000000005D30000-0x0000000005D44000-memory.dmp
memory/668-8-0x0000000006A20000-0x0000000006A82000-memory.dmp
memory/668-3-0x0000000005950000-0x0000000005960000-memory.dmp
memory/668-4-0x00000000057A0000-0x00000000057AA000-memory.dmp
memory/668-5-0x0000000005A00000-0x0000000005A9C000-memory.dmp
memory/668-0-0x0000000000D90000-0x0000000000E58000-memory.dmp
memory/668-7-0x0000000005950000-0x0000000005960000-memory.dmp
memory/668-2-0x00000000056E0000-0x0000000005772000-memory.dmp
memory/668-1-0x0000000005D70000-0x0000000006314000-memory.dmp
memory/3900-9-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3900-12-0x0000000005620000-0x0000000005630000-memory.dmp
memory/3900-13-0x0000000005620000-0x0000000005630000-memory.dmp
memory/3900-14-0x0000000006690000-0x00000000066E0000-memory.dmp
memory/3900-15-0x0000000006A50000-0x0000000006C12000-memory.dmp