masslogger | 7b95f4806961f68d97886bfadafe104f52dce41b6729f0c25b99c76d7be7d072

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SGPF260043917--41rolls.js
Size 921KB
Sample261104-mxz6favy2l
SHA256 7b95f4806961f68d97886bfadafe104f52dce41b6729f0c25b99c76d7be7d072
MD5 7b1ecf8076f718fe44f1b3febfbbcc07
SHA1 b07b74660948c3d3a36452bda25fea898e720ef1
SHA512 966223f0a2eb87c5ced19455d03ae3264603b1ce735622f913f05c45cc02e7bfab3678f04db327a5e93cfb6e271d81e7d54c96c82b1e65e0285535343b8ac922
SSDEEP 12288:Xk611H3vyRJg925UoO1TAQsR+Y8JIR1azngSKn/67olwiL+W0jqsdVpzWUeELKYu:XR/19kk1TAQaP88M7gV0osDnpPeUk
TLSH
T1441502579D07DE7B40291A0DE789CE03A065BE17907554A432CD4FAF9FABF24243CBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution masslogger spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
pro26.emailserver.vn
Port
587
Username
[email protected]
Password
shengyang@2023

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
00-00-0000
host_password
shengyang@2023
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
pro26.emailserver.vn
ssl_slate
True

Signatures

Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4728	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org
1	reallyfreegeoip.org
8	reallyfreegeoip.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4728 set thread context of 1884	4728	powershell.exe	91

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1760	taskkill.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
1884	aspnet_compiler.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	1884	aspnet_compiler.exe
Token: SeDebugPrivilege	1760	taskkill.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4728	2580	wscript.exe	89
PID 4728 wrote to memory of 1884	4728	powershell.exe	91
PID 4728 wrote to memory of 1884	4728	powershell.exe	91
PID 4728 wrote to memory of 1884	4728	powershell.exe	91
PID 4728 wrote to memory of 1884	4728	powershell.exe	91
PID 4728 wrote to memory of 1884	4728	powershell.exe	91
PID 2580 wrote to memory of 1760	2580	wscript.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SGPF260043917--41rolls.js
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_bSWRuFHIoYVl_1793789489873.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1884
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_bSWRuFHIoYVl_1793789489873.ps1

Path C:\Temp\ps_bSWRuFHIoYVl_1793789489873.ps1
Size 512KB
SHA256 16e66161dc09a4920765614fcca3c64b82bd2338768b351b12d376fe32068ce3
MD5 c7245e92360118bd527dbc3755a26b4c
SHA1 1651d4f3c439b59b59a90436ce577f058a37a30a
SHA512 1616365b13911067090f1d18498419d077d1720cea1ca4304ae757307642f76f94ec618c6ecd2a96d416ee767e523135a4d7f3ebad350da6a394d8f2fb7ac517
SSDEEP 12288:waTq6Yj3K8AzgS15rmJzTkmHMRyW1yDSuMw5TGLPRLK:wa2VbozduJfdMCSuMw5TGs
TLSH
T1A4B42334CDADA2EB4531E63B712255C1F27E630F6C824397B06CC8A87BF90699B6DC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1884-21-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1884-32-0x0000000006B90000-0x0000000006B9A000-memory.dmp

Download

memory/1884-31-0x0000000006BC0000-0x0000000006C52000-memory.dmp

Download

memory/1884-30-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/1884-29-0x0000000006CB0000-0x0000000006E72000-memory.dmp

Download

memory/1884-26-0x0000000006990000-0x00000000069E0000-memory.dmp

Download

memory/1884-25-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/1884-24-0x00000000058C0000-0x000000000595C000-memory.dmp

Download

memory/1884-23-0x0000000005FD0000-0x000000000658A000-memory.dmp

Download

memory/1884-22-0x00000000747F2000-0x00000000747F3000-memory.dmp

Download

memory/4728-10-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-12-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-16-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-18-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-17-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-19-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-20-0x0000024864170000-0x0000024864186000-memory.dmp

Download

memory/4728-14-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-13-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-15-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-11-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-1-0x00007FFD5908F000-0x00007FFD59090000-memory.dmp

Download

memory/4728-9-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-28-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-7-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-6-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-5-0x0000024864180000-0x00000248641A2000-memory.dmp

Download

memory/4728-2-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download

memory/4728-33-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp

Download