Analysis
- max time kernel
149s - max time network
116s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 02:39
General
- Target _0950c50ec518ed1e395f33f3b9a5d6c171c937c84ceb41f774139f93e374288f.ps1
- Size 176KB
- Sample260424-c5ppkac19t
- SHA256 0950c50ec518ed1e395f33f3b9a5d6c171c937c84ceb41f774139f93e374288f
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_0950c50ec518ed1e395f33f3b9a5d6c171c937c84ceb41f774139f93e374288f.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nnfordti\nnfordti.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CBA.tmp" "c:\Users\Admin\AppData\Local\Temp\nnfordti\CSCE90B33E2311B4D6EA996753A75F5B724.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES1CBA.tmp
__PSScriptPolicyTest_5ljv1gtl.vlp.ps1
nnfordti.dll
CSCE90B33E2311B4D6EA996753A75F5B724.TMP
nnfordti.0.cs
nnfordti.cmdline
memory/3104-25-0x0000000000600000-0x0000000000621000-memory.dmp
memory/3104-37-0x0000000005410000-0x0000000005420000-memory.dmp
memory/3104-36-0x0000000005410000-0x0000000005420000-memory.dmp
memory/3104-38-0x0000000005410000-0x0000000005420000-memory.dmp
memory/3104-32-0x0000000005410000-0x0000000005420000-memory.dmp
memory/3104-30-0x0000000005410000-0x0000000005420000-memory.dmp
memory/3104-31-0x00000000042A0000-0x00000000042EA000-memory.dmp
memory/4060-22-0x0000022EB5420000-0x0000022EB5428000-memory.dmp
memory/4060-26-0x0000022E9CEF0000-0x0000022E9CF02000-memory.dmp
memory/4060-27-0x0000022EB5460000-0x0000022EB5470000-memory.dmp
memory/4060-28-0x0000022EB5460000-0x0000022EB5470000-memory.dmp
memory/4060-24-0x0000022EB5460000-0x0000022EB5470000-memory.dmp
memory/4060-23-0x0000022EB5460000-0x0000022EB5470000-memory.dmp
memory/4060-0-0x0000022EB5460000-0x0000022EB5470000-memory.dmp
memory/4060-9-0x0000022EB5460000-0x0000022EB5470000-memory.dmp
memory/4060-3-0x0000022E9CF40000-0x0000022E9CF62000-memory.dmp
memory/4060-1-0x0000022EB5460000-0x0000022EB5470000-memory.dmp