Analysis
- max time kernel
149s - max time network
115s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 02:34
General
- Target COUNTRY.ps1
- Size 406KB
- Sample260424-c2sl2sc12v
- SHA256 fd24c1153ae53edff933d0c69346ee6105fa06d7b573bd0c5e8ae2ec2105d193
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\COUNTRY.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ecoexw22\ecoexw22.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BD0.tmp" "c:\Users\Admin\AppData\Local\Temp\ecoexw22\CSC9745FD4D9F2F438BACE1E8199BDEEFD.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES1BD0.tmp
__PSScriptPolicyTest_ny1qkvqt.mil.ps1
ecoexw22.dll
CSC9745FD4D9F2F438BACE1E8199BDEEFD.TMP
ecoexw22.0.cs
ecoexw22.cmdline
memory/580-18-0x0000012739800000-0x000001273980C000-memory.dmp
memory/1180-24-0x0000011C656D0000-0x0000011C656E0000-memory.dmp
memory/1180-27-0x0000011C4D0F0000-0x0000011C4D102000-memory.dmp
memory/1180-37-0x0000011C4D090000-0x0000011C4D09C000-memory.dmp
memory/1180-4-0x0000011C65810000-0x0000011C65832000-memory.dmp
memory/1180-23-0x0000011C65800000-0x0000011C65808000-memory.dmp
memory/1180-0-0x0000011C656D0000-0x0000011C656E0000-memory.dmp
memory/1180-25-0x0000011C656D0000-0x0000011C656E0000-memory.dmp
memory/1180-26-0x0000011C4D090000-0x0000011C4D09C000-memory.dmp
memory/1180-28-0x0000011C656D0000-0x0000011C656E0000-memory.dmp
memory/1180-8-0x0000011C656D0000-0x0000011C656E0000-memory.dmp
memory/3116-29-0x0000000001050000-0x000000000109C000-memory.dmp
memory/3116-31-0x00000000044C0000-0x000000000450A000-memory.dmp
memory/3116-34-0x0000000003180000-0x0000000003190000-memory.dmp
memory/3116-33-0x0000000003180000-0x0000000003190000-memory.dmp
memory/3116-32-0x0000000003180000-0x0000000003190000-memory.dmp
memory/3116-39-0x0000000003180000-0x0000000003190000-memory.dmp
memory/3116-41-0x0000000003180000-0x0000000003190000-memory.dmp
memory/3116-40-0x0000000004C40000-0x0000000004C75000-memory.dmp
memory/3116-42-0x0000000003180000-0x0000000003190000-memory.dmp
memory/3204-21-0x00000241CFC60000-0x00000241CFC6C000-memory.dmp