General
- Target 20042026_0134_19042026_RFQ_Artisan_ AR262579.zip
- Size 101KB
- Sample260420-bzl6tabs9s
- SHA256 b03b0573c115f3da3d1f97480b1f4973804b8eec60abba8c2d417dacbe25890e
Score
10/10
Malware Config
Targets
-
- Target RFQ_Artisan_ AR262579.bat
- Size 144KB
- SHA256 e7a79f75e515def0201bff72882520fc9577fb2c5f737a83009937c85d1143d8
Score10/10-
Detects DonutLoader
-
Detects SentinelRAT payload
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: SentinelRAT
SentinelRAT is a Windows remote access tool written in C#.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Adds Run key to start application
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1