Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 02:34
General
- Target COUNTRY.ps1
- Size 406KB
- Sample260424-c2sl2sc12v
- SHA256 fd24c1153ae53edff933d0c69346ee6105fa06d7b573bd0c5e8ae2ec2105d193
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\COUNTRY.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ypsw0rcd\ypsw0rcd.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES337F.tmp" "c:\Users\Admin\AppData\Local\Temp\ypsw0rcd\CSCAF9E4262F9764D31843752D59EF19F2.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES337F.tmp
__PSScriptPolicyTest_eq3sdyo1.rhq.ps1
ypsw0rcd.dll
CSCAF9E4262F9764D31843752D59EF19F2.TMP
ypsw0rcd.0.cs
ypsw0rcd.cmdline
memory/1488-20-0x00000269DBC90000-0x00000269DBC9C000-memory.dmp
memory/3296-41-0x0000000009420000-0x0000000009430000-memory.dmp
memory/3296-30-0x0000000000C90000-0x0000000000CDC000-memory.dmp
memory/3296-40-0x0000000009420000-0x0000000009430000-memory.dmp
memory/3296-42-0x0000000009420000-0x0000000009430000-memory.dmp
memory/3296-35-0x0000000009420000-0x0000000009430000-memory.dmp
memory/3296-34-0x0000000008C30000-0x0000000008C7A000-memory.dmp
memory/3296-33-0x0000000009420000-0x0000000009430000-memory.dmp
memory/4716-25-0x0000023D73420000-0x0000023D73428000-memory.dmp
memory/4716-28-0x0000023D5AD10000-0x0000023D5AD1C000-memory.dmp
memory/4716-29-0x0000023D73440000-0x0000023D734AB000-memory.dmp
memory/4716-26-0x0000023D73430000-0x0000023D73440000-memory.dmp
memory/4716-31-0x0000023D73430000-0x0000023D73440000-memory.dmp
memory/4716-27-0x0000023D73430000-0x0000023D73440000-memory.dmp
memory/4716-0-0x0000023D73430000-0x0000023D73440000-memory.dmp
memory/4716-38-0x0000023D5AD10000-0x0000023D5AD1C000-memory.dmp
memory/4716-39-0x0000023D73440000-0x0000023D734AB000-memory.dmp
memory/4716-10-0x0000023D73430000-0x0000023D73440000-memory.dmp
memory/4716-2-0x0000023D733C0000-0x0000023D733E2000-memory.dmp
memory/4716-1-0x0000023D73430000-0x0000023D73440000-memory.dmp
memory/4984-23-0x000002275AAD0000-0x000002275AADC000-memory.dmp