Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 02:34
General
- Target _f92d0596edc34fa3b1fd60022c44eb578a47db995f24c6adcf86331e81e87a72.ps1
- Size 121KB
- Sample260424-c2tt4sc12x
- SHA256 f92d0596edc34fa3b1fd60022c44eb578a47db995f24c6adcf86331e81e87a72
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_f92d0596edc34fa3b1fd60022c44eb578a47db995f24c6adcf86331e81e87a72.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ezg3zwf5\ezg3zwf5.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDED7.tmp" "c:\Users\Admin\AppData\Local\Temp\ezg3zwf5\CSC93F3924F3A46FF9DC051D984C73AFB.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hufhqa5a\hufhqa5a.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE109.tmp" "c:\Users\Admin\AppData\Local\Temp\hufhqa5a\CSCDE0FF4986DC64320A1F196CC91BE9CE.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESDED7.tmp
RESE109.tmp
__PSScriptPolicyTest_d53tkxwo.ff1.ps1
ezg3zwf5.dll
hufhqa5a.dll
CSC93F3924F3A46FF9DC051D984C73AFB.TMP
ezg3zwf5.0.cs
ezg3zwf5.cmdline
CSCDE0FF4986DC64320A1F196CC91BE9CE.TMP
hufhqa5a.0.cs
hufhqa5a.cmdline
memory/2072-23-0x0000011E106E0000-0x0000011E106EC000-memory.dmp
memory/2164-38-0x00000190D2F90000-0x00000190D2F9C000-memory.dmp
memory/3232-48-0x0000000008D40000-0x0000000008D8A000-memory.dmp
memory/3232-52-0x000000000A0B0000-0x000000000A272000-memory.dmp
memory/3232-45-0x0000000002CE0000-0x0000000002CF6000-memory.dmp
memory/3232-53-0x0000000004860000-0x00000000048B0000-memory.dmp
memory/3232-54-0x0000000026480000-0x00000000269A8000-memory.dmp
memory/4212-20-0x000001C4C46E0000-0x000001C4C46EC000-memory.dmp
memory/4496-35-0x0000020F35DC0000-0x0000020F35DCC000-memory.dmp
memory/4692-40-0x000001A0BAE40000-0x000001A0BAE48000-memory.dmp
memory/4692-41-0x000001A0BAE50000-0x000001A0BAE60000-memory.dmp
memory/4692-42-0x000001A0BAE50000-0x000001A0BAE60000-memory.dmp
memory/4692-43-0x000001A0A1030000-0x000001A0A103C000-memory.dmp
memory/4692-44-0x000001A0BAE50000-0x000001A0BAE60000-memory.dmp
memory/4692-1-0x000001A0BAE50000-0x000001A0BAE60000-memory.dmp
memory/4692-46-0x000001A0BAE50000-0x000001A0BAE60000-memory.dmp
memory/4692-25-0x000001A0BAE30000-0x000001A0BAE38000-memory.dmp
memory/4692-51-0x000001A0A1030000-0x000001A0A103C000-memory.dmp
memory/4692-10-0x000001A0BAE50000-0x000001A0BAE60000-memory.dmp
memory/4692-7-0x000001A0BAF60000-0x000001A0BAF82000-memory.dmp
memory/4692-0-0x000001A0BAE50000-0x000001A0BAE60000-memory.dmp