Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 02:39
General
- Target _0950c50ec518ed1e395f33f3b9a5d6c171c937c84ceb41f774139f93e374288f.ps1
- Size 176KB
- Sample260424-c5ppkac19t
- SHA256 0950c50ec518ed1e395f33f3b9a5d6c171c937c84ceb41f774139f93e374288f
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_0950c50ec518ed1e395f33f3b9a5d6c171c937c84ceb41f774139f93e374288f.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\md0azbkl\md0azbkl.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89CC.tmp" "c:\Users\Admin\AppData\Local\Temp\md0azbkl\CSC57A3AD6ACB04159B27997FEB99EA5CF.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES89CC.tmp
__PSScriptPolicyTest_d0i4kqvv.nz2.ps1
md0azbkl.dll
CSC57A3AD6ACB04159B27997FEB99EA5CF.TMP
md0azbkl.0.cs
md0azbkl.cmdline
memory/628-27-0x0000028EA6EB0000-0x0000028EA6EC0000-memory.dmp
memory/628-29-0x0000028EA5390000-0x0000028EA539C000-memory.dmp
memory/628-38-0x0000028EA5390000-0x0000028EA539C000-memory.dmp
memory/628-9-0x0000028EA6E30000-0x0000028EA6E52000-memory.dmp
memory/628-10-0x0000028EA6EB0000-0x0000028EA6EC0000-memory.dmp
memory/628-0-0x0000028EA6EB0000-0x0000028EA6EC0000-memory.dmp
memory/628-25-0x0000028EA6E20000-0x0000028EA6E28000-memory.dmp
memory/628-26-0x0000028EA6EB0000-0x0000028EA6EC0000-memory.dmp
memory/628-1-0x0000028EA6EB0000-0x0000028EA6EC0000-memory.dmp
memory/628-30-0x0000028EA6EB0000-0x0000028EA6EC0000-memory.dmp
memory/2480-20-0x000001E714930000-0x000001E71493C000-memory.dmp
memory/3204-28-0x00000000013B0000-0x00000000013D1000-memory.dmp
memory/3204-32-0x0000000007670000-0x00000000076BA000-memory.dmp
memory/3204-35-0x0000000009190000-0x00000000091A0000-memory.dmp
memory/3204-34-0x0000000009190000-0x00000000091A0000-memory.dmp
memory/3204-33-0x0000000009190000-0x00000000091A0000-memory.dmp
memory/3204-39-0x0000000009190000-0x00000000091A0000-memory.dmp
memory/3204-40-0x0000000009190000-0x00000000091A0000-memory.dmp
memory/3204-41-0x000000000BC60000-0x000000000BE22000-memory.dmp
memory/3204-42-0x0000000009AE0000-0x0000000009B30000-memory.dmp
memory/3204-43-0x0000000025FC0000-0x00000000264E8000-memory.dmp
memory/4580-23-0x00000223576F0000-0x00000223576FC000-memory.dmp