Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/04/2026, 02:49
General
- Target Congress.ps1
- Size 87KB
- Sample260427-dbbfhsbt7t
- SHA256 7ac07536c76c62c163ceabf2e2e877fe3877b3414d95d36d50d8d5838a548fed
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
dy8tm;jRtJO[:bG:
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-12-17
-
host_password
dy8tm;jRtJO[:bG:
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.taikei-rmc-co.biz
-
ssl_slate
True
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Detects DonutLoader 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Congress.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cbrmk52j\cbrmk52j.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DF3.tmp" "c:\Users\Admin\AppData\Local\Temp\cbrmk52j\CSC59D240989BD14A1B90A45DEA6DB19854.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES1DF3.tmp
__PSScriptPolicyTest_1li3zzqs.rxo.ps1
cbrmk52j.dll
CSC59D240989BD14A1B90A45DEA6DB19854.TMP
cbrmk52j.0.cs
cbrmk52j.cmdline
memory/1532-24-0x000002BD2D3D0000-0x000002BD2D3E0000-memory.dmp
memory/1532-37-0x000002BD2D4E0000-0x000002BD2DC8E000-memory.dmp
memory/1532-7-0x000002BD2DD30000-0x000002BD2DD52000-memory.dmp
memory/1532-1-0x000002BD2D3D0000-0x000002BD2D3E0000-memory.dmp
memory/1532-22-0x000002BD2DD20000-0x000002BD2DD28000-memory.dmp
memory/1532-23-0x000002BD2D3D0000-0x000002BD2D3E0000-memory.dmp
memory/1532-0-0x000002BD2D3D0000-0x000002BD2D3E0000-memory.dmp
memory/1532-25-0x000002BD2D3D0000-0x000002BD2D3E0000-memory.dmp
memory/1532-28-0x000002BD2D3D0000-0x000002BD2D3E0000-memory.dmp
memory/1532-27-0x000002BD2D390000-0x000002BD2D3A2000-memory.dmp
memory/1532-26-0x000002BD2D4E0000-0x000002BD2DC8E000-memory.dmp
memory/1532-9-0x000002BD2D3D0000-0x000002BD2D3E0000-memory.dmp
memory/3132-31-0x00000000071F0000-0x0000000007200000-memory.dmp
memory/3132-32-0x0000000002EF0000-0x0000000002F0E000-memory.dmp
memory/3132-33-0x00000000071F0000-0x0000000007200000-memory.dmp
memory/3132-34-0x00000000071F0000-0x0000000007200000-memory.dmp
memory/3132-29-0x0000000002AB0000-0x0000000002AC0000-memory.dmp
memory/3132-39-0x00000000052D0000-0x0000000005320000-memory.dmp
memory/3132-40-0x000000000EC40000-0x000000000EE02000-memory.dmp
memory/3132-41-0x00000000071F0000-0x0000000007200000-memory.dmp
memory/3132-42-0x00000000071F0000-0x0000000007200000-memory.dmp