Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
09/10/2026, 15:00
General
- Target PO-1366.pdf.js
- Size 495KB
- Sample261009-sdkjjay16m
- SHA256 96bce03ae9a4332933f67338bca131bcad6063cefce7f858778f6070609e772f
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.bomarkroyal.com
-
Port
587
-
Username
-
Password
bP@z@p6uXm%T
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
00-00-0000
-
host_password
bP@z@p6uXm%T
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.bomarkroyal.com
-
ssl_slate
False
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO-1366.pdf.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:WCGHN))2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\90236870945525.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\90236870945525.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:DEKHZGHSK))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:DEKHZGHSK))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:DEKHZGHSK))"4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\90236870945525.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
90236870945525.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1n3ybwhr.imz.ps1
handoff_dbg_4308_e58fc8b.txt
handoff_dbg_4308_e58fc8b.txt
memory/3548-392-0x0000000004F30000-0x0000000004F40000-memory.dmp
memory/3548-368-0x0000000002890000-0x00000000028A0000-memory.dmp
memory/3548-706-0x0000000002830000-0x0000000002840000-memory.dmp
memory/3548-719-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/3548-723-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/3548-724-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/3548-742-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/3548-743-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/3548-773-0x0000000005B50000-0x0000000005B60000-memory.dmp
memory/3548-779-0x0000000005C00000-0x0000000005C01000-memory.dmp
memory/3548-710-0x0000000002890000-0x00000000028A0000-memory.dmp
memory/3548-638-0x0000000005C50000-0x0000000005C5A000-memory.dmp
memory/3548-637-0x0000000005C90000-0x0000000005D22000-memory.dmp
memory/3548-526-0x0000000002830000-0x0000000002840000-memory.dmp
memory/3548-530-0x0000000002890000-0x00000000028A0000-memory.dmp
memory/3548-550-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/3548-557-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/3548-464-0x0000000000970000-0x000000000097A000-memory.dmp
memory/3548-461-0x0000000005DC0000-0x0000000005F82000-memory.dmp
memory/3548-359-0x0000000002810000-0x0000000002820000-memory.dmp
memory/3548-362-0x0000000002830000-0x0000000002840000-memory.dmp
memory/3548-99-0x0000000000740000-0x0000000000757000-memory.dmp
memory/3548-387-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/3548-394-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/3548-440-0x0000000054BC0000-0x0000000054BC1000-memory.dmp
memory/3548-75-0x0000000000830000-0x0000000000870000-memory.dmp
memory/3548-76-0x0000000000830000-0x0000000000870000-memory.dmp
memory/3548-442-0x0000000054BD0000-0x0000000054BD1000-memory.dmp
memory/3548-92-0x0000000000D10000-0x0000000000D30000-memory.dmp
memory/3548-90-0x0000000000830000-0x0000000000870000-memory.dmp
memory/3548-79-0x0000000010000000-0x0000000010040000-memory.dmp
memory/3548-446-0x0000000054BF0000-0x0000000054BF1000-memory.dmp
memory/3548-97-0x0000000004D60000-0x0000000004D7E000-memory.dmp
memory/3548-146-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3548-143-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3548-164-0x0000000010000000-0x0000000010040000-memory.dmp
memory/3548-142-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3548-121-0x0000000000D10000-0x0000000000D30000-memory.dmp
memory/3548-120-0x0000000000D10000-0x0000000000D30000-memory.dmp
memory/3548-117-0x00000000009E0000-0x00000000009F7000-memory.dmp
memory/3548-448-0x0000000054C00000-0x0000000054C01000-memory.dmp
memory/3548-104-0x0000000000820000-0x0000000000822000-memory.dmp
memory/3548-115-0x00000000009C0000-0x00000000009D0000-memory.dmp
memory/3548-98-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3548-170-0x00000000540E0000-0x00000000540E1000-memory.dmp
memory/3548-180-0x00000000560A0000-0x00000000560A1000-memory.dmp
memory/3548-178-0x0000000056090000-0x0000000056091000-memory.dmp
memory/3548-174-0x0000000054100000-0x0000000054101000-memory.dmp
memory/3548-172-0x00000000540F0000-0x00000000540F1000-memory.dmp
memory/3548-248-0x0000000002820000-0x0000000002830000-memory.dmp
memory/3548-208-0x00000000009C0000-0x00000000009D0000-memory.dmp
memory/3548-294-0x0000000004F90000-0x000000000502C000-memory.dmp
memory/3548-295-0x0000000005BA0000-0x0000000005BF0000-memory.dmp
memory/3548-313-0x00000000009C0000-0x00000000009D0000-memory.dmp
memory/4308-46-0x0000000005CC0000-0x0000000005CDE000-memory.dmp
memory/4308-36-0x00000000055F0000-0x0000000005656000-memory.dmp
memory/4308-35-0x0000000004E20000-0x0000000004E42000-memory.dmp
memory/4308-58-0x0000000070620000-0x000000007066C000-memory.dmp
memory/4308-73-0x0000000007500000-0x000000000751A000-memory.dmp
memory/4308-37-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/4308-72-0x00000000074C0000-0x00000000074D4000-memory.dmp
memory/4308-71-0x0000000007480000-0x000000000748E000-memory.dmp
memory/4308-70-0x00000000074A0000-0x00000000074B1000-memory.dmp
memory/4308-69-0x0000000007250000-0x000000000725A000-memory.dmp
memory/4308-68-0x0000000007290000-0x0000000007333000-memory.dmp
memory/4308-57-0x00000000071A0000-0x00000000071D2000-memory.dmp
memory/4308-74-0x00000000074F0000-0x00000000074F8000-memory.dmp
memory/4308-67-0x00000000071E0000-0x00000000071FE000-memory.dmp
memory/4308-34-0x0000000004FC0000-0x00000000055E8000-memory.dmp
memory/4308-33-0x0000000002820000-0x0000000002856000-memory.dmp
memory/4308-53-0x0000000007D00000-0x00000000082A4000-memory.dmp
memory/4308-52-0x0000000006EE0000-0x0000000006F02000-memory.dmp
memory/4308-51-0x0000000006F50000-0x0000000006FE6000-memory.dmp
memory/4308-50-0x0000000006230000-0x000000000624A000-memory.dmp
memory/4308-49-0x0000000007680000-0x0000000007CFA000-memory.dmp
memory/4308-47-0x0000000005CF0000-0x0000000005D3C000-memory.dmp
memory/4308-59-0x0000000070A00000-0x0000000070D54000-memory.dmp
memory/4308-45-0x00000000056D0000-0x0000000005A24000-memory.dmp
memory/5292-1-0x000001DD07170000-0x000001DD07192000-memory.dmp
memory/5292-0-0x000001DD1F2D0000-0x000001DD1F2E0000-memory.dmp
memory/5292-12-0x000001DD21350000-0x000001DD2156C000-memory.dmp