Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 02:47
General
- Target Lunch.ps1
- Size 176KB
- Sample260423-c9186ahs2v
- SHA256 5364a6db5cfb43f056be8dd0102124a425bd7b02c406b2f4af822b3e18106144
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Lunch.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yslb0c5w\yslb0c5w.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES28B1.tmp" "c:\Users\Admin\AppData\Local\Temp\yslb0c5w\CSCC1228905A79A45ADAB87974EA1C9D825.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES28B1.tmp
__PSScriptPolicyTest_k3iucvqg.gq2.ps1
yslb0c5w.dll
CSCC1228905A79A45ADAB87974EA1C9D825.TMP
yslb0c5w.0.cs
yslb0c5w.cmdline
memory/3032-20-0x000001563A000000-0x000001563A00C000-memory.dmp
memory/3272-67-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-72-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-118-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-117-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-116-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-115-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-111-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-113-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-69-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-114-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-112-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-31-0x0000000002B30000-0x0000000002B51000-memory.dmp
memory/3272-33-0x0000000008A90000-0x0000000008AA0000-memory.dmp
memory/3272-34-0x0000000008A40000-0x0000000008A8A000-memory.dmp
memory/3272-35-0x0000000008A90000-0x0000000008AA0000-memory.dmp
memory/3272-110-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-39-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-43-0x0000000008A90000-0x0000000008AA0000-memory.dmp
memory/3272-42-0x0000000008A90000-0x0000000008AA0000-memory.dmp
memory/3272-41-0x0000000008F30000-0x0000000008F40000-memory.dmp
memory/3272-40-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-44-0x00007FFA23702000-0x00007FFA23703000-memory.dmp
memory/3272-46-0x0000000008A90000-0x0000000008AA0000-memory.dmp
memory/3272-45-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-47-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-48-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-51-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-50-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-49-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-52-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-54-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-53-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-71-0x0000000008F30000-0x0000000008F40000-memory.dmp
memory/3272-56-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-61-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-63-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-62-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-60-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-59-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-58-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-57-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-64-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-65-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-109-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-68-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-66-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-55-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-105-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-106-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-70-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-74-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-73-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-75-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-77-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-76-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-78-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-81-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-80-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-79-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-82-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-83-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-84-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-85-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-91-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-90-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-92-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-89-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-88-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-87-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-86-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-93-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-94-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-96-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-95-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-97-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-98-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-99-0x00007FFA23660000-0x00007FFA23767000-memory.dmp
memory/3272-100-0x0000000009E90000-0x000000000A052000-memory.dmp
memory/3272-101-0x00000000030A0000-0x00000000030F0000-memory.dmp
memory/3272-102-0x0000000027430000-0x0000000027958000-memory.dmp
memory/3272-103-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-104-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-108-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3272-107-0x0000000008D30000-0x0000000008D40000-memory.dmp
memory/3464-23-0x0000019CC3F20000-0x0000019CC3F2C000-memory.dmp
memory/4764-28-0x0000022929F90000-0x0000022929FA0000-memory.dmp
memory/4764-0-0x0000022929F90000-0x0000022929FA0000-memory.dmp
memory/4764-38-0x0000022911800000-0x000002291180C000-memory.dmp
memory/4764-30-0x0000022929F90000-0x0000022929FA0000-memory.dmp
memory/4764-29-0x0000022911800000-0x000002291180C000-memory.dmp
memory/4764-27-0x0000022929F90000-0x0000022929FA0000-memory.dmp
memory/4764-26-0x0000022929F90000-0x0000022929FA0000-memory.dmp
memory/4764-25-0x0000022911970000-0x0000022911978000-memory.dmp
memory/4764-10-0x0000022929F90000-0x0000022929FA0000-memory.dmp
memory/4764-9-0x0000022929F50000-0x0000022929F72000-memory.dmp
memory/4764-1-0x0000022929F90000-0x0000022929FA0000-memory.dmp