Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
12/10/2025, 12:11
General
- Target jqqvLru0VAiH3z.exe
- Size 2.2MB
- Sample251012-pcxwpaaq4y
- SHA256 13bf1cfedc09e959f6fe09da8c9a687de9ed0d7ba10ca5839a6f0928429a1272
Malware Config
Signatures
- Detects DonutLoader 1 IoCs
- Detects MythicApollo 3 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- MythicApollo
Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.
- Mythicapollo family
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jqqvLru0VAiH3z.exe"C:\Users\Admin\AppData\Local\Temp\jqqvLru0VAiH3z.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1428-1-0x000001AA94730000-0x000001AA94947000-memory.dmp
memory/1428-2-0x000001AA96460000-0x000001AA96470000-memory.dmp
memory/1428-3-0x000001AAAEEA0000-0x000001AAAF0B6000-memory.dmp
memory/1428-5-0x000001AAAEC80000-0x000001AAAECD4000-memory.dmp
memory/1428-6-0x000001AA963C0000-0x000001AA963CC000-memory.dmp
memory/1428-12-0x000001AAAECF0000-0x000001AAAECFA000-memory.dmp
memory/1428-9-0x000001AA963B0000-0x000001AA963BE000-memory.dmp
memory/1428-11-0x000001AAAECD0000-0x000001AAAECDE000-memory.dmp
memory/1428-13-0x000001AAAED00000-0x000001AAAEE68000-memory.dmp
memory/1428-10-0x000001AA965A0000-0x000001AA965AE000-memory.dmp
memory/1428-8-0x000001AA96470000-0x000001AA96478000-memory.dmp
memory/1428-7-0x000001AA963D0000-0x000001AA963DA000-memory.dmp
memory/1428-15-0x000001AAB1270000-0x000001AAB127A000-memory.dmp
memory/1428-14-0x000001AA96460000-0x000001AA96470000-memory.dmp
memory/1428-4-0x000001AA96460000-0x000001AA96470000-memory.dmp
memory/1428-17-0x000001AAB1B90000-0x000001AAB1BCC000-memory.dmp
memory/1428-16-0x000001AAB1B30000-0x000001AAB1B42000-memory.dmp
memory/1428-18-0x000001AA96460000-0x000001AA96470000-memory.dmp
memory/1428-19-0x000001AA96460000-0x000001AA96470000-memory.dmp
memory/1428-20-0x000001AA96460000-0x000001AA96470000-memory.dmp
memory/1428-21-0x000001AA96460000-0x000001AA96470000-memory.dmp