Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 02:49
General
- Target _43d206a3928e1d6445113250bee9b2f8b0568b062280d28af8b496a5e76d4b78.ps1
- Size 105KB
- Sample260423-da9a6ahs5v
- SHA256 43d206a3928e1d6445113250bee9b2f8b0568b062280d28af8b496a5e76d4b78
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: SentinelRAT
SentinelRAT is a Windows remote access tool written in C#.
- Detects DonutLoader 1 IoCs
- Detects SentinelRAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_43d206a3928e1d6445113250bee9b2f8b0568b062280d28af8b496a5e76d4b78.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xwhz30y\0xwhz30y.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3747.tmp" "c:\Users\Admin\AppData\Local\Temp\0xwhz30y\CSC8FE64A64B7E14344AE1955B0853A594.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0xwhz30y.dll
RES3747.tmp
__PSScriptPolicyTest_qvsx1u0c.0tq.ps1
0xwhz30y.0.cs
0xwhz30y.cmdline
CSC8FE64A64B7E14344AE1955B0853A594.TMP
memory/3156-33-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/3156-29-0x00000000032E0000-0x00000000032F4000-memory.dmp
memory/3156-39-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/3156-40-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/3156-38-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/3156-31-0x0000000004960000-0x000000000497A000-memory.dmp
memory/3156-32-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/3156-34-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/4696-23-0x0000027029C20000-0x0000027029C30000-memory.dmp
memory/4696-27-0x0000027029C20000-0x0000027029C30000-memory.dmp
memory/4696-26-0x0000027029CB0000-0x0000027029CC2000-memory.dmp
memory/4696-25-0x0000027029C20000-0x0000027029C30000-memory.dmp
memory/4696-0-0x0000027029C20000-0x0000027029C30000-memory.dmp
memory/4696-24-0x0000027029C20000-0x0000027029C30000-memory.dmp
memory/4696-9-0x0000027029C20000-0x0000027029C30000-memory.dmp
memory/4696-22-0x0000027042300000-0x0000027042308000-memory.dmp
memory/4696-7-0x0000027042310000-0x0000027042332000-memory.dmp
memory/4696-8-0x0000027029C20000-0x0000027029C30000-memory.dmp