Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 21:00
General
- Target 68ceae64d7bd6c09e24598da9a4ab1e52f08a896384e8d3bc725c3688298d1bb.exe
- Size 650KB
- Sample260604-ztnpfsey7v
- SHA256 68ceae64d7bd6c09e24598da9a4ab1e52f08a896384e8d3bc725c3688298d1bb
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68ceae64d7bd6c09e24598da9a4ab1e52f08a896384e8d3bc725c3688298d1bb.exe"C:\Users\Admin\AppData\Local\Temp\68ceae64d7bd6c09e24598da9a4ab1e52f08a896384e8d3bc725c3688298d1bb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2228-0-0x00007FF7154D0000-0x00007FF71557A000-memory.dmp
memory/2228-10-0x000001C15F240000-0x000001C15F2D9000-memory.dmp
memory/2228-11-0x000001C15FD3A000-0x000001C15FD3B000-memory.dmp
memory/2228-12-0x000001C15F490000-0x000001C15F526000-memory.dmp
memory/2228-13-0x000001C179640000-0x000001C179788000-memory.dmp
memory/2228-14-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-15-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-16-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-18-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-19-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-20-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-21-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-22-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-23-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-25-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-27-0x000001C15F570000-0x000001C160032000-memory.dmp
memory/2228-29-0x000001C15F570000-0x000001C160032000-memory.dmp