masslogger | 399390fc1381845ca3d505b545fc1677f48fdf9c119fbdbeb5ffff2ea3d09f39

Analysis

max time kernel
300s
max time network
286s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GIE_ENQ-1080-2026 RFQ.js
Size 2.5MB
Sample260815-t25eaazeka
SHA256 399390fc1381845ca3d505b545fc1677f48fdf9c119fbdbeb5ffff2ea3d09f39
MD5 731e1ed9f6b124979879fd0b3adb1d39
SHA1 9649046544fea1165d0969a56b6398e2e40b1efb
SHA512 578537d8a9ba064701ae6e875d5d78eddd8638c255adf51c29ae04be6f1fcb41dbde768291b323834c09440269d92f8d47ce8f6f034722c8af03076540181fb2
SSDEEP 24576:6zlNeWZKU5RKYkGMeFzrUHynaCKGuOlUWWVi0zuMppGJz9N6l/e1BAw7Ej+l0nHE:gVbKymKlO6MMh404IVEynTDiVO3
TLSH
T10AC5419D39CCA1396016EE42CE6D7922582FBF2F5F4F0F86236D868C0F9125871579CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution masslogger persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.trimnt.com
Port
587
Username
[email protected]
Password
Vd4_wKiUILWQ*tRY

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
00-00-0000
host_password
Vd4_wKiUILWQ*tRY
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
mail.trimnt.com
ssl_slate
True

Signatures

Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4032	powershell.exe
4	4032	powershell.exe
5	4032	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4032	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org
1	reallyfreegeoip.org
4	reallyfreegeoip.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3352	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4032	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4032	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3352	4944	wscript.exe	90
PID 3352 wrote to memory of 4032	3352	wscript.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\GIE_ENQ-1080-2026 RFQ.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\8r2msuliys3\8r2msuliys3.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\8r2msuliys3\8r2msuliys3.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:4032

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8r2msuliys3.ps1

Path C:\Users\Admin\AppData\Local\Temp\8r2msuliys3\8r2msuliys3.ps1
Size 1KB
SHA256 a11987d09b9ea7e5852e3da2097fb69c32c17446f15198484e821a33eeea85d5
MD5 6964e0018a0dd17f8a373f9f7abcc88b
SHA1 249f10258ba5c152efeef15a922027147442b964
SHA512 2f9c13508922f63e4cf9e0e8467f1a138f2d7c7c49b92f9a7d93bb656fd8e1e7347aad61d5a7d3a0c5cec339d5699868ec4c2eeb757ae9f8a8cf4575493da413
TLSH
T1F731442C16C7EBADC3428453EA5219EF86F8BF0DA5492618F76DC488230E015D7896BB
MD5 SHA1 SHA512 TLSH

Submit Download

8r2msuliys3.vbs

Path C:\Users\Admin\AppData\Local\Temp\8r2msuliys3\8r2msuliys3.vbs
Size 228B
SHA256 d8a568f42eeb2a3c0da56a64c86c7fa010a289ee3022e9b5a30c1bc41d828f81
MD5 26eba700bf53ecb950c03a79daf934bc
SHA1 ea413b16c842ee08fac2d6fb8bfa4ce365395385
SHA512 631c67ea99eb13085fb14dc9c8731effb9c1bdcb10dac9711e01aa4b6b8fcb787f910b396875ac1c8576b9f45ff32435c57ccd8cc15da0b60407f3ff60edb026
TLSH
T1D1D097106179D28CCD24CC2600A3823C80E3E4682100171127708444B998169CB6912B
MD5 SHA1 SHA512 TLSH

Submit Download

8r2msuliys3a

Path C:\Users\Admin\AppData\Local\Temp\8r2msuliys3\8r2msuliys3a
Size 360KB
SHA256 622e7fabed3ac8a470f667124d26294d22c5fe77d0b0eaa672bbd4fad3bb0d4e
MD5 3afadb8725e3a24a0d2e3beca4ca193b
SHA1 54d93fd2d7806c10111f49d013767cc4f1f7bfdd
SHA512 862182a8d914ddb46e2fbce5f3f442c9492778c1b590574afd8984a7e6b95e9c1dda6f029bd0e44c85939d9dfaa999398ab3fdff55dc69f3cd3857b88b5b1a79
SSDEEP 6144:OHfY5lipdjlJM+fsGBHDyXFHdGxDn/agT3CNtboXiVGldlqZGLJMGAnarsrlwEKC:OHf0Uv3MQG8D/FyHJGHlqZGLKGAfwXvq
TLSH
T1FA7423628C8814E41DB9183AA6971BDD3FA7BB0BD0CCC0C84B71F29625DEF45B658327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8r2msuliys3b

Path C:\Users\Admin\AppData\Local\Temp\8r2msuliys3\8r2msuliys3b
Size 360KB
SHA256 d785fdcb432af045a2c357645944090d370f66e9a10b0ecba8301f6c9a42a8e8
MD5 5725561cf881acb1a6e7ad8c0d113e84
SHA1 e5bae3573d540f0850ec4197c92c5b7d0d5ddb1c
SHA512 1cd5f5ade4e964e9e9e49cff0aa74c064fceb2267908dcc3186fc63ef770ebd6a62d10ce0fe827bc7e75f718c5e5b670e8ceef349edda4cfd4336fcf82e0698c
SSDEEP 6144:s1ynvRMZdlpKKgoae8/1V/zHXxuOfWZm5XKWyykKDRDuJBzUbCAWdHXr7uWRF:s1kCvMKLv2HDfKmgSkKVuIbCxd3rp
TLSH
T1CF742312A610EE9BCA18102AECFFFE4D6EA92985C55FE4C5DEEF348F158B560909C052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4032-6-0x00000192452F0000-0x0000019245312000-memory.dmp

Download

memory/4032-12-0x0000019245700000-0x00000192458B0000-memory.dmp

Download

memory/4032-13-0x0000019245360000-0x00000192453B8000-memory.dmp

Download

memory/4032-14-0x00000192453C0000-0x00000192453DE000-memory.dmp

Download

memory/4032-15-0x0000019245430000-0x0000019245480000-memory.dmp

Download

memory/4032-16-0x0000019245BD0000-0x0000019245D92000-memory.dmp

Download