masslogger | f794036bb19b2c3880020071c559a1ae4879a7f8c6bf251b12ad6e662ee5c6f1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TRANSFERENCIA.js
Size 3.1MB
Sample260822-na2lestdla
SHA256 f794036bb19b2c3880020071c559a1ae4879a7f8c6bf251b12ad6e662ee5c6f1
MD5 1c2270353e7463f108274bf46f15432a
SHA1 492fba1efa58388705f0711b1e4ffef166d1d077
SHA512 81bc21ddf8baf5e772d82e95bfa82519238bb8f43b2fcdb29d4f67423113664af8f1f4b0259c39750656690963e79247f6f328eb9af9b26138dec3556ed1ef67
SSDEEP 24576:3zyybXVgrEXKGsfQOJACG8M2K9auIY3Hlr79xV:3z2rcKG6+nBD
TLSH
T1E3E514789E8A526D633ACF55C1CE20ABD169B207238E44D315C30ECF5FAB1666BC643D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution masslogger persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.bpl.com.mx
Port
587
Username
[email protected]
Password
Bprod22#

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
00-00-0000
host_password
Bprod22#
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
mail.bpl.com.mx
ssl_slate
False

Signatures

Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1264	powershell.exe
10	1264	powershell.exe
17	1264	powershell.exe
35	1264	powershell.exe
40	1264	powershell.exe
43	1264	powershell.exe
45	1264	powershell.exe
47	1264	powershell.exe
49	1264	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1264	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	checkip.dyndns.org
44	reallyfreegeoip.org
45	reallyfreegeoip.org
46	checkip.dyndns.org

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1264	powershell.exe
1264	powershell.exe
1264	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3264	1980	wscript.exe	86
PID 3264 wrote to memory of 1264	3264	conhost.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\18vamt4a42ha\18vamt4a42ha.ps1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\18vamt4a42ha\18vamt4a42ha.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1264

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18vamt4a42ha.ps1

Path C:\Users\Admin\AppData\Local\Temp\18vamt4a42ha\18vamt4a42ha.ps1
Size 1KB
SHA256 0ccebb087712b163d17a914c16a89337af076a6d633158fe3e3ad5fc6616faa9
MD5 583a756d89dcb06da784bb81ef0ede04
SHA1 8872059915568d479f0a364deadf9b768d3a7740
SHA512 70e5b45a0cbf764774146873e74f291b6f5eb344679eb6acd4373c00641a8b428d4cb2481b257ccc69d132a3b774b01b89d15b560b373b8dac09f132012988f1
TLSH
T132318751928FCEA908CDC173BE77C6CCEA646B0CD8C99F18B719D89012078786C9E3C5
MD5 SHA1 SHA512 TLSH

Submit Download

18vamt4a42haa

Path C:\Users\Admin\AppData\Local\Temp\18vamt4a42ha\18vamt4a42haa
Size 351KB
SHA256 c52689b2f7806c0eb0d553c60ada1a339b87cdd767f361582265f04c1de1d963
MD5 43e5f4ce7d5652ea6ce04063cddb702a
SHA1 0bcb03451c24e58c1975cd9c63ddc7bf388f26c7
SHA512 abb99dbde2e4d7f6892c3f352b7126a9c3788add7a8ed683b184c0e28a57ee749ca5473b03bf7d4c0f5f374547ce8a570a7e33c588dcc76590a5cbbf118c2165
SSDEEP 6144:BokfTyfyM8tClRg+0NTdKGNnem26jGWWlNdl4/o3cmiKA9dosTZzSy5:OkLaWugrT7nDrjdWLdWsXAHdzv
TLSH
T18A7423903DAFCBE5ACDDE2A41278CC1015E32A6D6554E4D243C5F8DC80AAF95A42FA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18vamt4a42hab

Path C:\Users\Admin\AppData\Local\Temp\18vamt4a42ha\18vamt4a42hab
Size 351KB
SHA256 dad86491788912e825c6d13b9327f772d460faa12ef60275ecafb7ccd716dce8
MD5 e85a138962d12d8a9a62f947410e53b0
SHA1 993a9c273a54622965ac96201a68032f9a0c4a17
SHA512 f1ff899a1a840243400af9f78602aa15762e67494b8d755f014c059a15e95f7480fc995cb5b30438b605a3aa595c8d93fca5a6113ba4b06580634fd8713c3cc8
SSDEEP 6144:ZcoMhx9+eASh4HYv8pk3nLGTHDYvS+ugUw9xSv1QtJMjT/zY0LHay3lf:ulx9CGbq0qL6SvfzRL3J
TLSH
T1F7742365293E4E8DF37DB52CA4BF362C46F52E091429A955A306760373AFFD32812C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_i33diqdx.pfb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i33diqdx.pfb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1264-16-0x000001C5EC330000-0x000001C5EC4D6000-memory.dmp

Download

memory/1264-5-0x000001C5EBD20000-0x000001C5EBD42000-memory.dmp

Download

memory/1264-4-0x000001C5E9540000-0x000001C5E9550000-memory.dmp

Download

memory/1264-18-0x000001C5EC4E0000-0x000001C5EC4FE000-memory.dmp

Download

memory/1264-17-0x000001C5EC070000-0x000001C5EC0C6000-memory.dmp

Download

memory/1264-19-0x000001C5E9540000-0x000001C5E9550000-memory.dmp

Download

memory/1264-21-0x000001C5E9540000-0x000001C5E9550000-memory.dmp

Download

memory/1264-20-0x000001C5EBD50000-0x000001C5EBF6C000-memory.dmp

Download

memory/1264-23-0x000001C5EBDA0000-0x000001C5EBDF0000-memory.dmp

Download

memory/1264-24-0x000001C5EC810000-0x000001C5EC9D2000-memory.dmp

Download