Analysis
- max time kernel
298s - max time network
298s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
07/05/2026, 13:43
General
- Target bwes.ps1
- Size 4.3MB
- Sample260507-q1krpsew8t
- SHA256 af31eb0fe9cf32ca91f3a5860b2dc6d403d821882e3e4fd14d18e7e704735b42
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 14 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bwes.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command -3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exe4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe4⤵
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\History\Low\0a5f361ef7b7bf765f5ff95ae90a2723\vlc.exe"C:\Users\Admin\AppData\Local\History\Low\0a5f361ef7b7bf765f5ff95ae90a2723\vlc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Sun\Java\9dbec57a.default-release\pythonw.exe"C:\Users\Admin\AppData\Roaming\Sun\Java\9dbec57a.default-release\pythonw.exe" "C:\Users\Admin\AppData\Roaming\Sun\Java\9dbec57a.default-release\helper.py"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\History\Low\0a5f361ef7b7bf765f5ff95ae90a2723\vlc.exeC:\Users\Admin\AppData\Local\History\Low\0a5f361ef7b7bf765f5ff95ae90a2723\vlc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Sun\Java\9dbec57a.default-release\pythonw.exeC:\Users\Admin\AppData\Roaming\Sun\Java\9dbec57a.default-release\pythonw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dfrqwqxjx.zip
libvlc.dll
dllhost.exe.log
vlc.exe
__PSScriptPolicyTest_tkaqgdrn.xc3.ps1
_ctypes.pyd
helper.py
libffi-8.dll
python3.DLL
python315._pth
python315.dll
python315.zip
pythonw.exe
vcruntime140.dll
memory/240-26-0x0000000007AC0000-0x000000000813A000-memory.dmp
memory/240-23-0x0000000006100000-0x000000000611E000-memory.dmp
memory/240-10-0x0000000002C50000-0x0000000002C60000-memory.dmp
memory/240-11-0x0000000002C60000-0x0000000002C96000-memory.dmp
memory/240-12-0x0000000005320000-0x000000000594A000-memory.dmp
memory/240-13-0x0000000005240000-0x0000000005262000-memory.dmp
memory/240-33-0x0000000007560000-0x00000000075D0000-memory.dmp
memory/240-34-0x0000000007680000-0x0000000007712000-memory.dmp
memory/240-35-0x0000000007610000-0x000000000765B000-memory.dmp
memory/240-36-0x0000000007770000-0x00000000077C1000-memory.dmp
memory/240-37-0x0000000002C50000-0x0000000002C60000-memory.dmp
memory/240-38-0x0000000000170000-0x00000000001D9000-memory.dmp
memory/240-39-0x0000000002C50000-0x0000000002C60000-memory.dmp
memory/240-14-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/240-15-0x00000000059C0000-0x0000000005A26000-memory.dmp
memory/240-22-0x0000000005BC0000-0x0000000005F17000-memory.dmp
memory/240-28-0x0000000008140000-0x00000000086E6000-memory.dmp
memory/240-24-0x0000000006130000-0x000000000617C000-memory.dmp
memory/240-27-0x0000000007460000-0x000000000747A000-memory.dmp
memory/240-25-0x0000000006650000-0x0000000006696000-memory.dmp
memory/2024-1479-0x00000000FF470000-0x00000000FF471000-memory.dmp
memory/2024-1457-0x00000000FF470000-0x00000000FF471000-memory.dmp
memory/2024-1471-0x00000000FF470000-0x00000000FF471000-memory.dmp
memory/2024-1460-0x00000000FF470000-0x00000000FF471000-memory.dmp
memory/2024-1462-0x00000000FF470000-0x00000000FF471000-memory.dmp
memory/2024-1463-0x00000000FF470000-0x00000000FF471000-memory.dmp
memory/2024-1467-0x00000000FF470000-0x00000000FF471000-memory.dmp
memory/2024-1465-0x00000000FF470000-0x00000000FF471000-memory.dmp
memory/3136-2927-0x0000000005450000-0x00000000054B8000-memory.dmp
memory/3136-2928-0x00000000054F0000-0x00000000054F6000-memory.dmp
memory/3568-42-0x0000000002AD0000-0x0000000002B18000-memory.dmp
memory/3568-61-0x0000000002B60000-0x0000000002B68000-memory.dmp
memory/3568-46-0x0000000005630000-0x0000000005642000-memory.dmp
memory/3568-45-0x0000000005470000-0x000000000548E000-memory.dmp
memory/3568-44-0x0000000005070000-0x00000000050E6000-memory.dmp
memory/3568-41-0x00000000009B0000-0x00000000009D2000-memory.dmp
memory/4208-32-0x0000019C218C0000-0x0000019C218D2000-memory.dmp
memory/4208-31-0x0000019C09350000-0x0000019C0935C000-memory.dmp
memory/4208-9-0x0000019C218E0000-0x0000019C218F0000-memory.dmp
memory/4208-8-0x0000019C21AB0000-0x0000019C21AD2000-memory.dmp
memory/4208-0-0x0000019C218E0000-0x0000019C218F0000-memory.dmp
memory/4208-1-0x0000019C218E0000-0x0000019C218F0000-memory.dmp
memory/5524-1408-0x000000006F350000-0x000000006F619000-memory.dmp
memory/5524-1456-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1503-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1407-0x0000000068C00000-0x00000000692E9000-memory.dmp
memory/5524-1397-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1383-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1355-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1292-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1449-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1404-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1440-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1429-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1422-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1415-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1406-0x000000006F620000-0x000000006F64F000-memory.dmp
memory/5524-1390-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1376-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1405-0x0000000000510000-0x0000000000610000-memory.dmp
memory/5524-1369-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1362-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1334-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1327-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1348-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1341-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1320-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1313-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1306-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1299-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1285-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1278-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1264-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1257-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1250-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1231-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-1228-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-1225-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-1223-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-1222-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-1271-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1243-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1234-0x0000000002D60000-0x00000000031AA000-memory.dmp
memory/5524-1236-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-73-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-75-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-76-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-78-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-80-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-92-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-84-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp
memory/5524-70-0x00000000FFBD0000-0x00000000FFBD1000-memory.dmp