Analysis
- user interaction
yes - max time kernel
66s - max time network
52s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/04/2026, 20:27
General
- Target Xerin 5.9.3.rar
- Size 12.8MB
- Sample260427-y8ppmac16q
- SHA256 c7114e999c674aadd4ca022675c3f9a03d0994cd2d7e34b1b5171fc526a44625
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 18 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Xerin 5.9.3.rar"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\XerinFuscator G3.exe"C:\Users\Admin\Desktop\XerinFuscator G3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\XerinFuscator G3.exe"C:\Users\Admin\Desktop\XerinFuscator G3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Xerin.CLI.exe"C:\Users\Admin\Desktop\Xerin.CLI.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
XerinFuscator G3.exe.log
Terminator.dll
Xerin.Auth.dll
Xerin.CLI.exe
Xerin.Core.dll
Xerin.Loader.dll
Xerin.Protections.dll
XerinFuscator G3.exe
memory/3404-82-0x0000000007050000-0x000000000738A000-memory.dmp
memory/3404-76-0x0000000005940000-0x00000000059A2000-memory.dmp
memory/3404-75-0x0000000005A40000-0x0000000005BBE000-memory.dmp
memory/3404-88-0x0000000005BF0000-0x0000000005BF8000-memory.dmp
memory/3404-70-0x0000000000BF0000-0x0000000000CA2000-memory.dmp
memory/3404-94-0x0000000001370000-0x00000000013EB000-memory.dmp
memory/3404-95-0x0000000005590000-0x00000000055F4000-memory.dmp
memory/4704-66-0x0000000001290000-0x000000000130B000-memory.dmp
memory/4704-67-0x0000000005180000-0x00000000051E4000-memory.dmp
memory/5664-44-0x0000000006540000-0x0000000006AE6000-memory.dmp
memory/5664-57-0x00000000054E0000-0x0000000005544000-memory.dmp
memory/5664-56-0x0000000001600000-0x000000000167B000-memory.dmp
memory/5664-53-0x000000000CDE0000-0x000000000CF16000-memory.dmp
memory/5664-49-0x0000000005630000-0x0000000005640000-memory.dmp
memory/5664-48-0x0000000009630000-0x0000000009844000-memory.dmp
memory/5664-47-0x0000000009200000-0x000000000962C000-memory.dmp
memory/5664-46-0x0000000007A70000-0x0000000007A7A000-memory.dmp
memory/5664-45-0x0000000006170000-0x0000000006202000-memory.dmp
memory/5664-43-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/5664-42-0x0000000005CE0000-0x0000000005F82000-memory.dmp
memory/5664-38-0x0000000005580000-0x0000000005581000-memory.dmp
memory/5664-37-0x0000000005630000-0x0000000005640000-memory.dmp
memory/5664-36-0x0000000000630000-0x0000000000AB8000-memory.dmp