Analysis
- max time kernel
598s - max time network
533s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 16:06
General
- Target Celestial.exe
- Size 19.1MB
- Sample260425-tkd6rsfv2r
- SHA256 d1727d7f05c28a2ba1b978f421f9020031e9a2eee2bdcd9ee9a56228e7e4a988
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celestial.exe"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_UjiTYhaLKpjIiWL.exe"C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_UjiTYhaLKpjIiWL.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_UjiTYhaLKpjIiWL.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_UjiTYhaLKpjIiWL-3212' -RunLevel Highest "3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout /t 4 /nobreak >nul & Del "C:\Users\Admin\AppData\Local\Temp\Celestial.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 4 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_UjiTYhaLKpjIiWL.exeC:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_UjiTYhaLKpjIiWL.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
CoreWorker_UjiTYhaLKpjIiWL.exe
__PSScriptPolicyTest_koxo1vdj.3jj.ps1
memory/344-117-0x0000020FF8200000-0x0000020FF8231000-memory.dmp
memory/344-119-0x0000020FF9ED0000-0x0000020FF9EE2000-memory.dmp
memory/344-118-0x0000020FF9AF0000-0x0000020FF9AFC000-memory.dmp
memory/1444-84-0x000001A00EB50000-0x000001A00EB81000-memory.dmp
memory/2516-121-0x000001A46CF40000-0x000001A46CF71000-memory.dmp
memory/2516-77-0x000001A46CB90000-0x000001A46CB9A000-memory.dmp
memory/3048-16-0x0000026DE4800000-0x0000026DE4812000-memory.dmp
memory/3048-9-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-14-0x0000026DE5230000-0x0000026DE5420000-memory.dmp
memory/3048-0-0x0000026DC9B00000-0x0000026DC9C23000-memory.dmp
memory/3048-17-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-2-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-3-0x0000026DE3F20000-0x0000026DE4042000-memory.dmp
memory/3048-20-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-4-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-24-0x0000026DE4820000-0x0000026DE4870000-memory.dmp
memory/3048-25-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-26-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-12-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-5-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-6-0x0000026DCB530000-0x0000026DCB531000-memory.dmp
memory/3048-7-0x0000026DE4210000-0x0000026DE43D2000-memory.dmp
memory/3048-42-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-8-0x0000026DE3E70000-0x0000026DE3EE6000-memory.dmp
memory/3048-13-0x0000026DE45E0000-0x0000026DE47D1000-memory.dmp
memory/3048-78-0x0000026DC9E30000-0x0000026DC9E61000-memory.dmp
memory/3048-79-0x0000026DCB4F0000-0x0000026DCB4FC000-memory.dmp
memory/3048-10-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3048-11-0x0000026DE4910000-0x0000026DE4E38000-memory.dmp
memory/3048-52-0x0000026DC9E30000-0x0000026DC9E61000-memory.dmp
memory/3048-53-0x0000026DCB4F0000-0x0000026DCB4FC000-memory.dmp
memory/3048-54-0x0000026DCB5C0000-0x0000026DCB5D0000-memory.dmp
memory/3196-41-0x000001563E730000-0x000001563E7E3000-memory.dmp
memory/3196-32-0x000001563E460000-0x000001563E482000-memory.dmp
memory/3196-57-0x0000015626270000-0x0000015626282000-memory.dmp
memory/3196-49-0x000001563EAA0000-0x000001563EAAA000-memory.dmp
memory/3196-48-0x000001563EA90000-0x000001563EA96000-memory.dmp
memory/3196-47-0x000001563E960000-0x000001563E968000-memory.dmp
memory/3196-46-0x000001563EAB0000-0x000001563EACA000-memory.dmp
memory/3196-45-0x000001563E950000-0x000001563E95A000-memory.dmp
memory/3196-44-0x000001563E970000-0x000001563E98C000-memory.dmp
memory/3196-43-0x000001563E7F0000-0x000001563E7FA000-memory.dmp
memory/3196-56-0x00000156261C0000-0x00000156261CC000-memory.dmp
memory/3196-40-0x000001563E710000-0x000001563E72C000-memory.dmp
memory/3196-55-0x0000015624450000-0x0000015624481000-memory.dmp
memory/3492-120-0x000001E103AC0000-0x000001E103AF1000-memory.dmp
memory/3832-18-0x00000197C82E0000-0x00000197C82F0000-memory.dmp
memory/3896-21-0x00000118BFD30000-0x00000118BFD4E000-memory.dmp
memory/3896-19-0x00000118BFCC0000-0x00000118BFCD0000-memory.dmp
memory/4192-114-0x00000179DA690000-0x00000179DA6A2000-memory.dmp
memory/4192-113-0x00000179D8B50000-0x00000179D8B5C000-memory.dmp
memory/4192-104-0x00000179F2B30000-0x00000179F2BE3000-memory.dmp
memory/4192-112-0x00000179D8A50000-0x00000179D8A81000-memory.dmp