Resubmissions
20/09/2026, 10:36
260920-mnczjsab771020/09/2026, 07:07
260920-hx3jcadp5x1008/09/2026, 15:38
260908-s27nzagd9315/08/2026, 21:05
260815-zw6ytat1ez15/08/2026, 20:50
260815-zmxnsatzgs15/08/2026, 20:46
260815-zkklfatcnf15/08/2026, 20:40
260815-zf5e2stcjb15/08/2026, 20:39
260815-zfqlwstydz14/08/2026, 18:03
260814-wm9fssyyev06/08/2026, 22:09
260806-124lbabl4sAnalysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 12:54
General
- Target Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
- Size 782KB
- Sample260712-p5a8dsas8k
- SHA256 a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b
Malware Config
Extracted
-
masslogger
-
https://api.telegram.org/bot7557609045:AAHgxfWXqRPgwr5JAhsZqLlIJvPQkqavC0g/sendMessage?chat_id=671054766
-
exfiltration_mode
#TGEnabled
-
expire_time_date
2025-07-13
-
ssl_slate
False
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2584-8-0x0000000074192000-0x0000000074193000-memory.dmp
memory/2584-10-0x0000000007450000-0x00000000074B2000-memory.dmp
memory/2584-2-0x0000000005140000-0x00000000056FA000-memory.dmp
memory/2584-3-0x0000000004C80000-0x0000000004D12000-memory.dmp
memory/2584-4-0x0000000004D40000-0x0000000004D4A000-memory.dmp
memory/2584-5-0x0000000004DF0000-0x0000000004E8C000-memory.dmp
memory/2584-6-0x0000000074180000-0x000000007493C000-memory.dmp
memory/2584-7-0x0000000004F70000-0x0000000004F84000-memory.dmp
memory/2584-1-0x00000000000A0000-0x0000000000168000-memory.dmp
memory/2584-0-0x0000000074192000-0x0000000074193000-memory.dmp
memory/2584-9-0x0000000074180000-0x000000007493C000-memory.dmp
memory/2584-14-0x0000000074180000-0x000000007493C000-memory.dmp
memory/5760-12-0x0000000074180000-0x000000007493C000-memory.dmp
memory/5760-13-0x0000000074180000-0x000000007493C000-memory.dmp
memory/5760-11-0x0000000000400000-0x000000000041E000-memory.dmp
memory/5760-15-0x0000000006B60000-0x0000000006BB0000-memory.dmp
memory/5760-16-0x0000000006E80000-0x0000000007042000-memory.dmp
memory/5760-17-0x0000000074180000-0x000000007493C000-memory.dmp