Analysis
- max time kernel
149s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 10:43
General
- Target Trick.ps1
- Size 119KB
- Sample260423-mshetsas8w
- SHA256 40d804b9813d3a6d40b7f33db2c2a09eeeff1b06413f2dfb06442176b4589b9f
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Trick.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\et2j31t0\et2j31t0.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29BB.tmp" "c:\Users\Admin\AppData\Local\Temp\et2j31t0\CSC5DE07260838B46E1BC83CDAED35EE9D.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES29BB.tmp
__PSScriptPolicyTest_4ja4cfma.ddh.ps1
et2j31t0.dll
CSC5DE07260838B46E1BC83CDAED35EE9D.TMP
et2j31t0.0.cs
et2j31t0.cmdline
memory/832-20-0x00000230EDE70000-0x00000230EDE7C000-memory.dmp
memory/1992-26-0x0000016CFA600000-0x0000016CFA610000-memory.dmp
memory/1992-30-0x0000016CF9FF0000-0x0000016CFA002000-memory.dmp
memory/1992-9-0x0000016CFA600000-0x0000016CFA610000-memory.dmp
memory/1992-2-0x0000016CFA020000-0x0000016CFA042000-memory.dmp
memory/1992-40-0x0000016CF8610000-0x0000016CF861C000-memory.dmp
memory/1992-25-0x0000016CFA0B0000-0x0000016CFA0B8000-memory.dmp
memory/1992-1-0x0000016CFA600000-0x0000016CFA610000-memory.dmp
memory/1992-0-0x0000016CFA600000-0x0000016CFA610000-memory.dmp
memory/1992-27-0x0000016CFA600000-0x0000016CFA610000-memory.dmp
memory/1992-28-0x0000016CFA600000-0x0000016CFA610000-memory.dmp
memory/1992-29-0x0000016CF8610000-0x0000016CF861C000-memory.dmp
memory/1992-10-0x0000016CFA600000-0x0000016CFA610000-memory.dmp
memory/1992-31-0x0000016CFA600000-0x0000016CFA610000-memory.dmp
memory/3140-32-0x0000000000B50000-0x0000000000B66000-memory.dmp
memory/3140-34-0x00000000059F0000-0x0000000005A00000-memory.dmp
memory/3140-35-0x0000000004AD0000-0x0000000004B1A000-memory.dmp
memory/3140-37-0x00000000059F0000-0x0000000005A00000-memory.dmp
memory/3140-36-0x00000000059F0000-0x0000000005A00000-memory.dmp
memory/3140-42-0x00000000059F0000-0x0000000005A00000-memory.dmp
memory/3140-44-0x00000000059F0000-0x0000000005A00000-memory.dmp
memory/3140-43-0x00000000059F0000-0x0000000005A00000-memory.dmp
memory/4832-23-0x000001C2E6B10000-0x000001C2E6B1C000-memory.dmp