Analysis
- user interaction
yes - max time kernel
900s - max time network
836s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/05/2026, 16:44
General
- Target 7429cdb2-a570-38f8-1bd6-7948dd879018.eml
- Size 2.4MB
- Sample260522-t84fkacy4x
- SHA256 dd225ea5febf96a018fea0a63ed3c476c0f0ee9e876e002f920249cd7a8570d2
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 5 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 12 IoCs
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 35 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\7429cdb2-a570-38f8-1bd6-7948dd879018.eml"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.zip\PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.JS"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe"C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe" C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.ttf2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.zip\PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.JS"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe"C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe" C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.zip\PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.JS"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe"C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe" C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.zip\PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.JS"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe"C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe" C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26\PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.JS"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe"C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.exe" C:\Users\Public\Libraries\AMRNWUQYZPLPVFGO.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.zip
PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.zip:Zone.Identifier
AMRNWUQYZPLPVFGO.exe
AMRNWUQYZPLPVFGO.ttf
memory/2144-162-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-164-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-154-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-155-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-157-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-156-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-159-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-158-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-166-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-163-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-165-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-234-0x000000002B210000-0x000000002B260000-memory.dmp
memory/2144-153-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-161-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-245-0x000000002B9A0000-0x000000002B9AA000-memory.dmp
memory/2144-160-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-167-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-244-0x000000002B880000-0x000000002B912000-memory.dmp
memory/2144-169-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-233-0x000000002B020000-0x000000002B1E2000-memory.dmp
memory/2144-168-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/2144-235-0x000000002B2E0000-0x000000002B80C000-memory.dmp
memory/2480-41-0x00007FFC32424000-0x00007FFC32425000-memory.dmp
memory/2480-88-0x000001E0E6B30000-0x000001E0E6C87000-memory.dmp
memory/2480-9-0x00007FFC32380000-0x00007FFC32589000-memory.dmp
memory/2480-6-0x00007FFC32380000-0x00007FFC32589000-memory.dmp
memory/2480-7-0x00007FFC32380000-0x00007FFC32589000-memory.dmp
memory/2480-11-0x00007FFC32380000-0x00007FFC32589000-memory.dmp
memory/2480-10-0x00007FFC32380000-0x00007FFC32589000-memory.dmp
memory/2480-43-0x00007FFC32380000-0x00007FFC32589000-memory.dmp
memory/2480-42-0x00007FFC32380000-0x00007FFC32589000-memory.dmp
memory/2480-8-0x00007FFC32380000-0x00007FFC32589000-memory.dmp
memory/2480-0-0x00007FFBF2410000-0x00007FFBF2420000-memory.dmp
memory/2480-13-0x00007FFBEFBF0000-0x00007FFBEFC00000-memory.dmp
memory/2480-1-0x00007FFC32424000-0x00007FFC32425000-memory.dmp
memory/2480-2-0x00007FFBF2410000-0x00007FFBF2420000-memory.dmp
memory/2480-12-0x00007FFBEFBF0000-0x00007FFBEFC00000-memory.dmp
memory/2480-3-0x00007FFBF2410000-0x00007FFBF2420000-memory.dmp
memory/2480-4-0x00007FFBF2410000-0x00007FFBF2420000-memory.dmp
memory/2480-5-0x00007FFBF2410000-0x00007FFBF2420000-memory.dmp
memory/4996-105-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-139-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-138-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-137-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-136-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-134-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-128-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-126-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-133-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-132-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-131-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-130-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-125-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-129-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-124-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-143-0x0000000015F30000-0x0000000016F30000-memory.dmp
memory/4996-144-0x0000000002DB0000-0x0000000002DFA000-memory.dmp
memory/4996-145-0x000000002A0E0000-0x000000002A686000-memory.dmp
memory/4996-146-0x0000000002EF0000-0x0000000002F8C000-memory.dmp
memory/4996-140-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-141-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-142-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-135-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-127-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-123-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-122-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-121-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-115-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-116-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-120-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-118-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-119-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-117-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-113-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-114-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-111-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-112-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-110-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-107-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-109-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-108-0x000000007FE70000-0x000000007FE80000-memory.dmp
memory/4996-106-0x000000007FE70000-0x000000007FE80000-memory.dmp