Analysis
- max time kernel
29s - max time network
33s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 03:00
General
- Target ENJOY.ps1
- Size 176KB
- Sample260423-dhbd4ahv41
- SHA256 e178ec2c637f8340288d0928c5de1a852e5f6fdded6327cfb3fc2c752f0c88cd
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ENJOY.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\enoezpkh\enoezpkh.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3A.tmp" "c:\Users\Admin\AppData\Local\Temp\enoezpkh\CSC8490DFAA3EE24DCA87C3B7FB2412EFC8.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESD3A.tmp
__PSScriptPolicyTest_db0wsv1y.eru.ps1
enoezpkh.dll
CSC8490DFAA3EE24DCA87C3B7FB2412EFC8.TMP
enoezpkh.0.cs
enoezpkh.cmdline
memory/1108-24-0x000002157FA00000-0x000002157FA10000-memory.dmp
memory/1108-26-0x000002157F9B0000-0x000002157F9C2000-memory.dmp
memory/1108-8-0x000002157FA00000-0x000002157FA10000-memory.dmp
memory/1108-39-0x000002157F3A0000-0x000002157F3AC000-memory.dmp
memory/1108-1-0x000002157FA80000-0x000002157FAA2000-memory.dmp
memory/1108-23-0x000002157FAF0000-0x000002157FAF8000-memory.dmp
memory/1108-0-0x000002157FA00000-0x000002157FA10000-memory.dmp
memory/1108-25-0x000002157F3A0000-0x000002157F3AC000-memory.dmp
memory/1108-27-0x000002157FA00000-0x000002157FA10000-memory.dmp
memory/3124-29-0x0000000002800000-0x0000000002821000-memory.dmp
memory/3124-31-0x0000000004330000-0x000000000437A000-memory.dmp
memory/3124-36-0x0000000008390000-0x00000000083A0000-memory.dmp
memory/3124-35-0x0000000008390000-0x00000000083A0000-memory.dmp
memory/3124-34-0x0000000008390000-0x00000000083A0000-memory.dmp
memory/3124-41-0x0000000008390000-0x00000000083A0000-memory.dmp
memory/3124-43-0x0000000008390000-0x00000000083A0000-memory.dmp
memory/3124-42-0x0000000008390000-0x00000000083A0000-memory.dmp
memory/4924-18-0x0000023ADA820000-0x0000023ADA82C000-memory.dmp
memory/5016-21-0x000001E1D48B0000-0x000001E1D48BC000-memory.dmp