Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 02:47
General
- Target Lunch.ps1
- Size 176KB
- Sample260423-c9186ahs2v
- SHA256 5364a6db5cfb43f056be8dd0102124a425bd7b02c406b2f4af822b3e18106144
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 58 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Lunch.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nnmku2qt\nnmku2qt.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B2D.tmp" "c:\Users\Admin\AppData\Local\Temp\nnmku2qt\CSC4061CE37E99F436D9F2C466676BDBEE3.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES4B2D.tmp
__PSScriptPolicyTest_dhpzggye.c1o.ps1
nnmku2qt.dll
CSC4061CE37E99F436D9F2C466676BDBEE3.TMP
nnmku2qt.0.cs
nnmku2qt.cmdline
memory/1604-23-0x0000022781750000-0x000002278175C000-memory.dmp
memory/3112-36-0x0000000005320000-0x0000000005330000-memory.dmp
memory/3112-42-0x0000000005320000-0x0000000005330000-memory.dmp
memory/3112-47-0x0000000010000000-0x0000000010528000-memory.dmp
memory/3112-46-0x0000000005240000-0x0000000005290000-memory.dmp
memory/3112-45-0x0000000008670000-0x0000000008832000-memory.dmp
memory/3112-44-0x0000000005320000-0x0000000005330000-memory.dmp
memory/3112-43-0x0000000005320000-0x0000000005330000-memory.dmp
memory/3112-37-0x0000000005320000-0x0000000005330000-memory.dmp
memory/3112-34-0x0000000005320000-0x0000000005330000-memory.dmp
memory/3112-35-0x0000000004BF0000-0x0000000004C3A000-memory.dmp
memory/3112-32-0x0000000000BE0000-0x0000000000C01000-memory.dmp
memory/4396-1-0x0000020013DF0000-0x0000020013E00000-memory.dmp
memory/4396-9-0x0000020013DF0000-0x0000020013E00000-memory.dmp
memory/4396-29-0x0000020012330000-0x000002001233C000-memory.dmp
memory/4396-28-0x0000020013DF0000-0x0000020013E00000-memory.dmp
memory/4396-27-0x0000020013DF0000-0x0000020013E00000-memory.dmp
memory/4396-26-0x0000020013DF0000-0x0000020013E00000-memory.dmp
memory/4396-10-0x0000020013DF0000-0x0000020013E00000-memory.dmp
memory/4396-30-0x0000020013DA0000-0x0000020013DB2000-memory.dmp
memory/4396-31-0x0000020013DF0000-0x0000020013E00000-memory.dmp
memory/4396-25-0x000002002C520000-0x000002002C528000-memory.dmp
memory/4396-0-0x0000020013DF0000-0x0000020013E00000-memory.dmp
memory/4396-7-0x0000020013E00000-0x0000020013E22000-memory.dmp
memory/4396-40-0x0000020012330000-0x000002001233C000-memory.dmp
memory/5100-20-0x00000193816D0000-0x00000193816DC000-memory.dmp