Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
29/04/2026, 11:50
General
- Target SHARP.ps1
- Size 404KB
- Sample260429-nzyk3abs2w
- SHA256 41f2eb06bbc035bfe092eca2556c62bd081380e3fb7b084abc2174db4084e949
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\SHARP.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4xfvalec\4xfvalec.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21AC.tmp" "c:\Users\Admin\AppData\Local\Temp\4xfvalec\CSC87D4146C1A049A2A06CF016BC70D2D4.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
4xfvalec.dll
RES21AC.tmp
__PSScriptPolicyTest_pjf54isy.hyx.ps1
4xfvalec.0.cs
4xfvalec.cmdline
CSC87D4146C1A049A2A06CF016BC70D2D4.TMP
memory/3232-34-0x000000000B2C0000-0x000000000B2D0000-memory.dmp
memory/3232-30-0x0000000000D60000-0x0000000000DAC000-memory.dmp
memory/3232-42-0x000000000B2C0000-0x000000000B2D0000-memory.dmp
memory/3232-41-0x000000000B2C0000-0x000000000B2D0000-memory.dmp
memory/3232-40-0x000000000B2C0000-0x000000000B2D0000-memory.dmp
memory/3232-32-0x000000000B2C0000-0x000000000B2D0000-memory.dmp
memory/3232-33-0x0000000008750000-0x000000000879A000-memory.dmp
memory/3356-21-0x00000162763E0000-0x0000016276435000-memory.dmp
memory/3356-22-0x00000162762B0000-0x00000162762B8000-memory.dmp
memory/4524-24-0x0000022776440000-0x0000022776448000-memory.dmp
memory/4524-29-0x0000022776030000-0x0000022776040000-memory.dmp
memory/4524-28-0x0000022776030000-0x0000022776040000-memory.dmp
memory/4524-0-0x0000022776030000-0x0000022776040000-memory.dmp
memory/4524-27-0x000002275DA80000-0x000002275DA88000-memory.dmp
memory/4524-26-0x000002275C100000-0x000002275C155000-memory.dmp
memory/4524-37-0x000002275C100000-0x000002275C155000-memory.dmp
memory/4524-25-0x0000022776030000-0x0000022776040000-memory.dmp
memory/4524-2-0x0000022775FB0000-0x0000022775FD2000-memory.dmp
memory/4524-1-0x0000022776030000-0x0000022776040000-memory.dmp