Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
29/04/2026, 11:50
General
- Target SHARP.ps1
- Size 404KB
- Sample260429-nzyk3abs2w
- SHA256 41f2eb06bbc035bfe092eca2556c62bd081380e3fb7b084abc2174db4084e949
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\SHARP.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mlb5x32x\mlb5x32x.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3217.tmp" "c:\Users\Admin\AppData\Local\Temp\mlb5x32x\CSC99E3036486264DE3B073F399115FDA7.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES3217.tmp
__PSScriptPolicyTest_exwn3xlf.rjx.ps1
mlb5x32x.dll
CSC99E3036486264DE3B073F399115FDA7.TMP
mlb5x32x.0.cs
mlb5x32x.cmdline
memory/708-19-0x000001ACC7120000-0x000001ACC712C000-memory.dmp
memory/800-22-0x00000137CACB0000-0x00000137CACBC000-memory.dmp
memory/3124-31-0x00000000008E0000-0x000000000092C000-memory.dmp
memory/3124-36-0x0000000006E40000-0x0000000006E50000-memory.dmp
memory/3124-41-0x0000000006E40000-0x0000000006E50000-memory.dmp
memory/3124-42-0x0000000006E40000-0x0000000006E50000-memory.dmp
memory/3124-43-0x0000000006E40000-0x0000000006E50000-memory.dmp
memory/3124-33-0x00000000045F0000-0x000000000463A000-memory.dmp
memory/3124-34-0x0000000006E40000-0x0000000006E50000-memory.dmp
memory/3124-35-0x0000000006E40000-0x0000000006E50000-memory.dmp
memory/4756-25-0x000001EDE9BD0000-0x000001EDE9BE0000-memory.dmp
memory/4756-29-0x000001EDE9BD0000-0x000001EDE9BE0000-memory.dmp
memory/4756-0-0x000001EDE9BD0000-0x000001EDE9BE0000-memory.dmp
memory/4756-28-0x000001EDE9730000-0x000001EDE9742000-memory.dmp
memory/4756-27-0x000001EDE7D30000-0x000001EDE7D3C000-memory.dmp
memory/4756-26-0x000001EDE9BD0000-0x000001EDE9BE0000-memory.dmp
memory/4756-9-0x000001EDE9BD0000-0x000001EDE9BE0000-memory.dmp
memory/4756-39-0x000001EDE7D30000-0x000001EDE7D3C000-memory.dmp
memory/4756-24-0x000001EDE9780000-0x000001EDE9788000-memory.dmp
memory/4756-1-0x000001EDE9BD0000-0x000001EDE9BE0000-memory.dmp
memory/4756-8-0x000001EDE9B80000-0x000001EDE9BA2000-memory.dmp