Analysis
- max time kernel
149s - max time network
118s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 02:34
General
- Target _f92d0596edc34fa3b1fd60022c44eb578a47db995f24c6adcf86331e81e87a72.ps1
- Size 121KB
- Sample260424-c2tt4sc12x
- SHA256 f92d0596edc34fa3b1fd60022c44eb578a47db995f24c6adcf86331e81e87a72
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
iz5$#j)Fq(0g+?Hh
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_f92d0596edc34fa3b1fd60022c44eb578a47db995f24c6adcf86331e81e87a72.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lnqkxbl4\lnqkxbl4.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22C5.tmp" "c:\Users\Admin\AppData\Local\Temp\lnqkxbl4\CSC44A3D0323151478086888C95DE3BBA31.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ur3hcx2x\ur3hcx2x.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2517.tmp" "c:\Users\Admin\AppData\Local\Temp\ur3hcx2x\CSCAA5D66DFB2FB4CE5B7E372EBA271A5EC.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES22C5.tmp
RES2517.tmp
__PSScriptPolicyTest_l0n0ytka.dl2.ps1
lnqkxbl4.dll
ur3hcx2x.dll
CSC44A3D0323151478086888C95DE3BBA31.TMP
lnqkxbl4.0.cs
lnqkxbl4.cmdline
CSCAA5D66DFB2FB4CE5B7E372EBA271A5EC.TMP
ur3hcx2x.0.cs
ur3hcx2x.cmdline
memory/1828-20-0x00000200A5330000-0x00000200A533C000-memory.dmp
memory/2664-38-0x000001DD81750000-0x000001DD8175C000-memory.dmp
memory/3104-56-0x000000000FDF0000-0x0000000010318000-memory.dmp
memory/3104-55-0x0000000003180000-0x00000000031D0000-memory.dmp
memory/3104-54-0x0000000007FE0000-0x00000000081A2000-memory.dmp
memory/3104-49-0x0000000004520000-0x000000000456A000-memory.dmp
memory/3104-47-0x00000000030C0000-0x00000000030D6000-memory.dmp
memory/3540-1-0x0000017645E70000-0x0000017645E80000-memory.dmp
memory/3540-44-0x000001762D830000-0x000001762D83C000-memory.dmp
memory/3540-40-0x0000017645F70000-0x0000017645F78000-memory.dmp
memory/3540-10-0x0000017645E70000-0x0000017645E80000-memory.dmp
memory/3540-41-0x0000017645E70000-0x0000017645E80000-memory.dmp
memory/3540-42-0x0000017645E70000-0x0000017645E80000-memory.dmp
memory/3540-43-0x0000017645E70000-0x0000017645E80000-memory.dmp
memory/3540-2-0x0000017645F90000-0x0000017645FB2000-memory.dmp
memory/3540-45-0x000001762D8D0000-0x000001762D8E2000-memory.dmp
memory/3540-46-0x0000017645E70000-0x0000017645E80000-memory.dmp
memory/3540-0-0x0000017645E70000-0x0000017645E80000-memory.dmp
memory/3540-25-0x0000017645F60000-0x0000017645F68000-memory.dmp
memory/3540-52-0x000001762D830000-0x000001762D83C000-memory.dmp
memory/3540-9-0x0000017645E70000-0x0000017645E80000-memory.dmp
memory/4796-23-0x00000212E0170000-0x00000212E017C000-memory.dmp
memory/4920-35-0x0000028B6D8D0000-0x0000028B6D8DC000-memory.dmp