masslogger | 11167bd52115a338895b2f6c9929718bd8ef50b9bfa7b3d01da11a523fdd2a95

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ B34245.vbs
Size 1.5MB
Sample260817-ffjc2ahe49
SHA256 11167bd52115a338895b2f6c9929718bd8ef50b9bfa7b3d01da11a523fdd2a95
MD5 1f65ae3b6859ffa6f7f881fffac14f02
SHA1 6fb2da8ce98999785fd4aaa8697af6d9495e534b
SHA512 586b80bb3cf1fcadc0a709324923a8c1f12187e990de0471316974698953da7407c5f355345f9eec00a4c2bc3f19d629b005cecf2e455e4127ead7cbe440a5c9
SSDEEP 24576:AuVMj4lyelIu5r/k+JTqfZTw6FxfsUG+0R9pEOKhg6lrMQWkKaRSV5:Z7I2Sxdm0CZ
TLSH
T1B275406179857C84B07AD112DACBC7A7E0A8FE91F727160665E7839803F0744BD83AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution masslogger persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.trimnt.com
Port
587
Username
[email protected]
Password
Vd4_wKiUILWQ*tRY

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
00-00-0000
host_password
Vd4_wKiUILWQ*tRY
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
mail.trimnt.com
ssl_slate
True

Signatures

Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
29	3244	powershell.exe
32	3244	powershell.exe
37	3244	powershell.exe
40	3244	powershell.exe
42	3244	powershell.exe
47	3244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3244	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
28	checkip.dyndns.org
41	reallyfreegeoip.org
42	reallyfreegeoip.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2880	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3244	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3244	2880	WScript.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ B34245.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\58E4B49E\58E4B49E.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:3244

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58E4B49E.ps1

Path C:\Users\Admin\AppData\Local\Temp\58E4B49E\58E4B49E.ps1
Size 1KB
SHA256 6dd7679a9a7b59462b5a3a95429c09e5c6f684e8c019c1b8dcacd7a7fbcb7a20
MD5 99aec3f6d451afb448c7f5f2f27cfec5
SHA1 00ab2f973727f30ea5c9736c3f186d707cfc8b46
SHA512 a251616cc779438aceb0c86a5be6b2dd115ee087d1d7afde6b2ab6f7f10c22da89a60944884b328870f78dadbd3f58d8b8b15454df0da7b52013cc51ad28f8a5
TLSH
T1FE31546103D3D53514E190B39E6C8AEC86782E4DA5C9B2B4B78CC568335941C7BED3CB
MD5 SHA1 SHA512 TLSH

Submit Download

58E4B49Ea

Path C:\Users\Admin\AppData\Local\Temp\58E4B49E\58E4B49Ea
Size 360KB
SHA256 34165addc850843092234035d80fbbda9e53345f3d95d8558ce8a15f253e8e47
MD5 6cfe5fad074ef9d04280e7cb5f576763
SHA1 3400d41d382ae7bba0d3d1ecc38d855aca3b0a96
SHA512 d2afea3868967ab8d659aec5cf869b85510bf41153b30cafc5b964a21f49e4db140bb4cf9d07cd0e7f171f2be762e208bc160769f8d4bbf59223eb78ad20580a
SSDEEP 6144:dp3ceZzGVPWzQB21x7uOe0TrR7ZNC5rjz2qxz5VWw9j2WuUXCR6X4qwM3i7sE0Yl:dBjZKVPWcSz3UX9VfnvuRkIqwMSYE0Yl
TLSH
T18C7423351ABB7CA8229CF1F463AF9F0D38A3475A849256DAB73C31D333417E1568346A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58E4B49Eb

Path C:\Users\Admin\AppData\Local\Temp\58E4B49E\58E4B49Eb
Size 360KB
SHA256 94be1cc6f1babf5222b272cdef50db3d214e55833f4bbbe2c409d59754403643
MD5 b4a84aa196c925af86369c1d3594f7a3
SHA1 9451063bac54695f58a8333f3b1b7aa8e48d5dde
SHA512 c4f821cab6cc1e56df6881998e5f1a535b9903c8a768b58391184b4c7a4123647da56582e8682e431017331f0d7bbcea49e2ecb1105d930e9fbb46fb344d972a
SSDEEP 6144:Ni3n+YL/+ggy7rSRrUZe2JtGuYCNAF0pLtu9vEkjCqb6iF6+KkjEh09TCw+6/C8:Ni3pLbgyw27GTCNe+tPQ6iP/jEheGs68
TLSH
T1957423528979E5EF0A282125957FFFDA61664BF1F99CDAB3A730B84B600C68D0307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4npxqxyu.nvo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4npxqxyu.nvo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3244-4-0x0000022AE5390000-0x0000022AE53A0000-memory.dmp

Download

memory/3244-5-0x0000022AFEC10000-0x0000022AFEC32000-memory.dmp

Download

memory/3244-16-0x0000022AFEFA0000-0x0000022AFF150000-memory.dmp

Download

memory/3244-17-0x0000022AFF150000-0x0000022AFF1A8000-memory.dmp

Download

memory/3244-18-0x0000022AFF1B0000-0x0000022AFF1CE000-memory.dmp

Download

memory/3244-19-0x0000022AE5390000-0x0000022AE53A0000-memory.dmp

Download

memory/3244-20-0x0000022AFF360000-0x0000022AFF3B0000-memory.dmp

Download

memory/3244-21-0x0000022AFF580000-0x0000022AFF742000-memory.dmp

Download