Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
12/10/2025, 12:11
General
- Target jqqvLru0VAiH3z.exe
- Size 2.2MB
- Sample251012-pcxwpaaq4y
- SHA256 13bf1cfedc09e959f6fe09da8c9a687de9ed0d7ba10ca5839a6f0928429a1272
Malware Config
Signatures
- Detects DonutLoader 2 IoCs
- Detects MythicApollo 3 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- MythicApollo
Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.
- Mythicapollo family
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jqqvLru0VAiH3z.exe"C:\Users\Admin\AppData\Local\Temp\jqqvLru0VAiH3z.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1872-1-0x0000024C42670000-0x0000024C42887000-memory.dmp
memory/1872-2-0x0000024C5CDF0000-0x0000024C5CE00000-memory.dmp
memory/1872-3-0x0000024C5D020000-0x0000024C5D236000-memory.dmp
memory/1872-4-0x0000024C5CDF0000-0x0000024C5CE00000-memory.dmp
memory/1872-5-0x0000024C442F0000-0x0000024C44344000-memory.dmp
memory/1872-6-0x0000024C42620000-0x0000024C4262C000-memory.dmp
memory/1872-9-0x0000024C42610000-0x0000024C4261E000-memory.dmp
memory/1872-12-0x0000024C44340000-0x0000024C4434A000-memory.dmp
memory/1872-11-0x0000024C442C0000-0x0000024C442CE000-memory.dmp
memory/1872-13-0x0000024C5CC80000-0x0000024C5CDE8000-memory.dmp
memory/1872-8-0x0000024C42640000-0x0000024C42648000-memory.dmp
memory/1872-10-0x0000024C42650000-0x0000024C4265E000-memory.dmp
memory/1872-7-0x0000024C42630000-0x0000024C4263A000-memory.dmp
memory/1872-14-0x0000024C443A0000-0x0000024C443AA000-memory.dmp
memory/1872-15-0x0000024C5CDF0000-0x0000024C5CE00000-memory.dmp
memory/1872-16-0x0000024C44520000-0x0000024C44532000-memory.dmp
memory/1872-17-0x0000024C5CF00000-0x0000024C5CF3C000-memory.dmp
memory/1872-18-0x0000024C5CDF0000-0x0000024C5CE00000-memory.dmp
memory/1872-19-0x0000024C5CDF0000-0x0000024C5CE00000-memory.dmp
memory/1872-20-0x0000024C5CDF0000-0x0000024C5CE00000-memory.dmp
memory/1872-21-0x0000024C5CDF0000-0x0000024C5CE00000-memory.dmp