Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
27/04/2026, 02:49
General
- Target Congress.ps1
- Size 87KB
- Sample260427-dbbfhsbt7t
- SHA256 7ac07536c76c62c163ceabf2e2e877fe3877b3414d95d36d50d8d5838a548fed
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
dy8tm;jRtJO[:bG:
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-12-17
-
host_password
dy8tm;jRtJO[:bG:
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.taikei-rmc-co.biz
-
ssl_slate
True
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Detects DonutLoader 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Congress.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mo5humql\mo5humql.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85F4.tmp" "c:\Users\Admin\AppData\Local\Temp\mo5humql\CSC8A18C6C32DD142A48CAAE41888973ECC.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES85F4.tmp
__PSScriptPolicyTest_1a2vryzx.zdu.ps1
mo5humql.dll
CSC8A18C6C32DD142A48CAAE41888973ECC.TMP
mo5humql.0.cs
mo5humql.cmdline
memory/1832-22-0x0000018D59060000-0x0000018D5906C000-memory.dmp
memory/1832-21-0x0000018D58F70000-0x0000018D58FC5000-memory.dmp
memory/2824-36-0x00000288745F0000-0x0000028874645000-memory.dmp
memory/2824-0-0x0000028874D50000-0x0000028874D60000-memory.dmp
memory/2824-24-0x0000028874760000-0x0000028874768000-memory.dmp
memory/2824-8-0x0000028874D90000-0x0000028874DB2000-memory.dmp
memory/2824-25-0x0000028874D50000-0x0000028874D60000-memory.dmp
memory/2824-26-0x00000288745F0000-0x0000028874645000-memory.dmp
memory/2824-27-0x0000028872E10000-0x0000028872E1C000-memory.dmp
memory/2824-28-0x0000028874D50000-0x0000028874D60000-memory.dmp
memory/2824-37-0x0000028872E10000-0x0000028872E1C000-memory.dmp
memory/3268-32-0x0000000008E70000-0x0000000008E80000-memory.dmp
memory/3268-33-0x0000000008E70000-0x0000000008E80000-memory.dmp
memory/3268-31-0x0000000002890000-0x00000000028AE000-memory.dmp
memory/3268-29-0x0000000000AF0000-0x0000000000B00000-memory.dmp
memory/3268-38-0x0000000008E80000-0x0000000008ED0000-memory.dmp
memory/3268-39-0x000000000C560000-0x000000000C722000-memory.dmp
memory/3268-40-0x0000000008E70000-0x0000000008E80000-memory.dmp
memory/3268-41-0x0000000008E70000-0x0000000008E80000-memory.dmp
memory/3268-42-0x0000000008E70000-0x0000000008E80000-memory.dmp
memory/4788-18-0x0000028B4E4F0000-0x0000028B4E4FC000-memory.dmp