Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 02:49
General
- Target _43d206a3928e1d6445113250bee9b2f8b0568b062280d28af8b496a5e76d4b78.ps1
- Size 105KB
- Sample260423-da9a6ahs5v
- SHA256 43d206a3928e1d6445113250bee9b2f8b0568b062280d28af8b496a5e76d4b78
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: SentinelRAT
SentinelRAT is a Windows remote access tool written in C#.
- Detects DonutLoader 2 IoCs
- Detects SentinelRAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_43d206a3928e1d6445113250bee9b2f8b0568b062280d28af8b496a5e76d4b78.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lvsz5hfs\lvsz5hfs.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE9.tmp" "c:\Users\Admin\AppData\Local\Temp\lvsz5hfs\CSC52B53C8FB84A4AAA9C13D392B0643A96.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESFE9.tmp
__PSScriptPolicyTest_yrq5gtws.3hl.ps1
lvsz5hfs.dll
CSC52B53C8FB84A4AAA9C13D392B0643A96.TMP
lvsz5hfs.0.cs
lvsz5hfs.cmdline
memory/3216-31-0x0000000000A30000-0x0000000000A44000-memory.dmp
memory/3216-33-0x00000000099C0000-0x00000000099D0000-memory.dmp
memory/3216-42-0x00000000099C0000-0x00000000099D0000-memory.dmp
memory/3216-40-0x00000000099C0000-0x00000000099D0000-memory.dmp
memory/3216-41-0x00000000099C0000-0x00000000099D0000-memory.dmp
memory/3216-35-0x00000000099C0000-0x00000000099D0000-memory.dmp
memory/3216-36-0x00000000099C0000-0x00000000099D0000-memory.dmp
memory/3216-34-0x0000000002870000-0x000000000288A000-memory.dmp
memory/4480-25-0x000001D6A8230000-0x000001D6A8238000-memory.dmp
memory/4480-28-0x000001D68FD40000-0x000001D68FD50000-memory.dmp
memory/4480-29-0x000001D68FB30000-0x000001D68FB3C000-memory.dmp
memory/4480-30-0x000001D68FD40000-0x000001D68FD50000-memory.dmp
memory/4480-0-0x000001D68FD40000-0x000001D68FD50000-memory.dmp
memory/4480-27-0x000001D68FD40000-0x000001D68FD50000-memory.dmp
memory/4480-26-0x000001D68FD40000-0x000001D68FD50000-memory.dmp
memory/4480-10-0x000001D68FD40000-0x000001D68FD50000-memory.dmp
memory/4480-1-0x000001D6A8100000-0x000001D6A8122000-memory.dmp
memory/4480-39-0x000001D68FB30000-0x000001D68FB3C000-memory.dmp
memory/4480-9-0x000001D68FD40000-0x000001D68FD50000-memory.dmp
memory/4520-20-0x00000135F8370000-0x00000135F837C000-memory.dmp
memory/5948-23-0x000001BE781A0000-0x000001BE781AC000-memory.dmp