Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 06:38
General
- Target New Order - RS-6.JS.js
- Size 3.4MB
- Sample261027-hd8agsa14w
- SHA256 ac74ebb7e8bb4beb09c00d8605c315e682a9824d8333851c41bed8ffde74dcae
Malware Config
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
00-00-0000
-
host_password
Batang2025!
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.yihquan.co.id
-
ssl_slate
True
Signatures
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\New Order - RS-6.JS.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\New Order - RS-6.JS.js:Zone.Identifier"2⤵
- Executes a command shell one-liner
- NTFS ADS
-
-
C:\Users\Admin\Documents\UFTQYOFZTBOPGTTG.exe"C:\Users\Admin\Documents\UFTQYOFZTBOPGTTG.exe" C:\Users\Admin\Documents\GTTGPOBTZFOYQTFU2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\GTTGPOBTZFOYQTFU.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\UFTQYOFZTBOPGTTG.exe"C:\Users\Admin\Documents\UFTQYOFZTBOPGTTG.exe" "C:\Users\Admin\Documents\GTTGPOBTZFOYQTFU"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
GTTGPOBTZFOYQTFU
GTTGPOBTZFOYQTFU.vbs
UFTQYOFZTBOPGTTG.exe
UFTQYOFZTBOPGTTG.mui
memory/5420-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-19-0x0000000002780000-0x0000000002781000-memory.dmp
memory/5420-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-25-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/5420-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-24-0x0000000002790000-0x0000000002791000-memory.dmp
memory/5420-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-76-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-75-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-74-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-73-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5420-181-0x0000000074CD2000-0x0000000074CD3000-memory.dmp
memory/5420-182-0x00000000298F0000-0x000000002990E000-memory.dmp
memory/5420-183-0x00000000299E0000-0x0000000029F9A000-memory.dmp
memory/5420-184-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5420-185-0x0000000029FA0000-0x000000002A03C000-memory.dmp
memory/5420-186-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5420-187-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5420-188-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5420-196-0x000000002ACA0000-0x000000002ACF0000-memory.dmp
memory/5420-365-0x000000002AE40000-0x000000002B002000-memory.dmp
memory/5420-366-0x0000000074CD2000-0x0000000074CD3000-memory.dmp
memory/5420-367-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5420-372-0x000000002B0A0000-0x000000002B132000-memory.dmp
memory/5420-374-0x000000002B1B0000-0x000000002B1BA000-memory.dmp