Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 15:00
General
- Target PO-1366.pdf.js
- Size 495KB
- Sample261009-sdkjjay16m
- SHA256 96bce03ae9a4332933f67338bca131bcad6063cefce7f858778f6070609e772f
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.bomarkroyal.com
-
Port
587
-
Username
-
Password
bP@z@p6uXm%T
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
00-00-0000
-
host_password
bP@z@p6uXm%T
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.bomarkroyal.com
-
ssl_slate
False
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO-1366.pdf.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:WCGHN))2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\90236870945525.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\90236870945525.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:DEKHZGHSK))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:DEKHZGHSK))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:DEKHZGHSK))"4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\90236870945525.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
90236870945525.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_4whs35ar.arr.psm1
handoff_dbg_4660_e59f15b.txt
handoff_dbg_4660_e59f15b.txt
memory/4660-28-0x00000000055A0000-0x0000000005606000-memory.dmp
memory/4660-35-0x00000000061F0000-0x000000000623C000-memory.dmp
memory/4660-55-0x00000000081A0000-0x00000000081A8000-memory.dmp
memory/4660-54-0x00000000081B0000-0x00000000081CC000-memory.dmp
memory/4660-53-0x0000000007AD0000-0x0000000007AE5000-memory.dmp
memory/4660-52-0x0000000007AC0000-0x0000000007AD0000-memory.dmp
memory/4660-27-0x0000000005500000-0x0000000005522000-memory.dmp
memory/4660-29-0x0000000005610000-0x0000000005676000-memory.dmp
memory/4660-51-0x0000000007AA0000-0x0000000007AB1000-memory.dmp
memory/4660-30-0x0000000005D80000-0x00000000060DB000-memory.dmp
memory/4660-34-0x00000000061B0000-0x00000000061CE000-memory.dmp
memory/4660-26-0x0000000005730000-0x0000000005D7A000-memory.dmp
memory/4660-36-0x0000000007B10000-0x000000000818C000-memory.dmp
memory/4660-37-0x0000000006780000-0x000000000679A000-memory.dmp
memory/4660-38-0x0000000007570000-0x0000000007606000-memory.dmp
memory/4660-39-0x0000000007500000-0x0000000007522000-memory.dmp
memory/4660-40-0x0000000008750000-0x0000000008D0A000-memory.dmp
memory/4660-25-0x0000000002EE0000-0x0000000002F16000-memory.dmp
memory/4660-43-0x00000000077E0000-0x0000000007816000-memory.dmp
memory/4660-44-0x0000000070580000-0x00000000705CC000-memory.dmp
memory/4660-45-0x0000000070790000-0x0000000070AEB000-memory.dmp
memory/4660-48-0x0000000007820000-0x0000000007840000-memory.dmp
memory/4660-49-0x0000000007840000-0x00000000078E3000-memory.dmp
memory/4660-50-0x0000000007940000-0x000000000794A000-memory.dmp
memory/4780-147-0x0000000010000000-0x0000000010040000-memory.dmp
memory/4780-302-0x0000000001420000-0x0000000001430000-memory.dmp
memory/4780-757-0x0000000005BB0000-0x0000000005BC0000-memory.dmp
memory/4780-750-0x0000000005B60000-0x0000000005B70000-memory.dmp
memory/4780-751-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/4780-56-0x0000000001270000-0x00000000012B0000-memory.dmp
memory/4780-57-0x0000000001270000-0x00000000012B0000-memory.dmp
memory/4780-60-0x0000000010000000-0x0000000010040000-memory.dmp
memory/4780-71-0x0000000001270000-0x00000000012B0000-memory.dmp
memory/4780-720-0x00000000054E0000-0x00000000054F0000-memory.dmp
memory/4780-79-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4780-128-0x0000000002E40000-0x0000000002E50000-memory.dmp
memory/4780-230-0x0000000002E40000-0x0000000002E50000-memory.dmp
memory/4780-163-0x0000000056530000-0x0000000056531000-memory.dmp
memory/4780-161-0x0000000056520000-0x0000000056521000-memory.dmp
memory/4780-153-0x0000000053B40000-0x0000000053B41000-memory.dmp
memory/4780-698-0x0000000003040000-0x0000000003050000-memory.dmp
memory/4780-125-0x0000000002E20000-0x0000000002E21000-memory.dmp
memory/4780-275-0x0000000005610000-0x00000000056AC000-memory.dmp
memory/4780-108-0x0000000002CE0000-0x0000000002D00000-memory.dmp
memory/4780-107-0x0000000002CE0000-0x0000000002D00000-memory.dmp
memory/4780-197-0x0000000001420000-0x0000000001430000-memory.dmp
memory/4780-92-0x00000000012B0000-0x00000000012C7000-memory.dmp
memory/4780-84-0x0000000000EF0000-0x0000000000EF2000-memory.dmp
memory/4780-157-0x0000000053B60000-0x0000000053B61000-memory.dmp
memory/4780-155-0x0000000053B50000-0x0000000053B51000-memory.dmp
memory/4780-76-0x0000000002F90000-0x0000000002FAE000-memory.dmp
memory/4780-124-0x0000000002E10000-0x0000000002E11000-memory.dmp
memory/4780-103-0x0000000001420000-0x0000000001430000-memory.dmp
memory/4780-102-0x0000000001400000-0x0000000001417000-memory.dmp
memory/4780-702-0x0000000003090000-0x00000000030A0000-memory.dmp
memory/4780-73-0x0000000002CE0000-0x0000000002D00000-memory.dmp
memory/4780-277-0x0000000006190000-0x00000000061E0000-memory.dmp
memory/4780-711-0x0000000003100000-0x0000000003110000-memory.dmp
memory/4780-367-0x0000000003100000-0x0000000003110000-memory.dmp
memory/4780-343-0x0000000002E30000-0x0000000002E40000-memory.dmp
memory/4780-405-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/4780-375-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4780-433-0x00000000545F0000-0x00000000545F1000-memory.dmp
memory/4780-434-0x0000000054600000-0x0000000054601000-memory.dmp
memory/4780-428-0x00000000545D0000-0x00000000545D1000-memory.dmp
memory/4780-426-0x00000000545C0000-0x00000000545C1000-memory.dmp
memory/4780-376-0x0000000005510000-0x0000000005520000-memory.dmp
memory/4780-374-0x00000000054E0000-0x00000000054F0000-memory.dmp
memory/4780-446-0x00000000063B0000-0x0000000006572000-memory.dmp
memory/4780-530-0x0000000003100000-0x0000000003110000-memory.dmp
memory/4780-539-0x00000000054E0000-0x00000000054F0000-memory.dmp
memory/4780-582-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/4780-540-0x00000000054F0000-0x0000000005500000-memory.dmp
memory/4780-623-0x00000000009A0000-0x00000000009AB000-memory.dmp
memory/4780-624-0x00000000062C0000-0x0000000006352000-memory.dmp
memory/4780-625-0x0000000006260000-0x000000000626A000-memory.dmp
memory/4780-703-0x00000000030A0000-0x00000000030B0000-memory.dmp
memory/4912-8-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-0-0x00007FFB361EF000-0x00007FFB361F0000-memory.dmp
memory/4912-3-0x000002393B3B0000-0x000002393B3D2000-memory.dmp
memory/4912-4-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-5-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-6-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-7-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-9-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-10-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-12-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-14-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp
memory/4912-15-0x00007FFB36060000-0x00007FFB36A04000-memory.dmp