Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 21:07
General
- Target 903b80e6d7a10c2c285975ad52845b6bd24ee5f9055515df064e7e9dbe82746c.exe
- Size 724KB
- Sample260604-zyfveae16x
- SHA256 903b80e6d7a10c2c285975ad52845b6bd24ee5f9055515df064e7e9dbe82746c
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\903b80e6d7a10c2c285975ad52845b6bd24ee5f9055515df064e7e9dbe82746c.exe"C:\Users\Admin\AppData\Local\Temp\903b80e6d7a10c2c285975ad52845b6bd24ee5f9055515df064e7e9dbe82746c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\InnerException\TargetSite.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -Force ; Add-MpPreference -ExclusionProcess 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\InnerException\TargetSite.exe' -Force"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -Command "System.Collections.Generic.List`1[System.String]"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\InnerException\TargetSite.exeC:\Users\Admin\AppData\Roaming\InnerException\TargetSite.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\InnerException\TargetSite.exeC:\Users\Admin\AppData\Roaming\InnerException\TargetSite.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_e3py1ta3.qha.ps1
TargetSite.exe
memory/1172-2865-0x00000295FA830000-0x00000295FA840000-memory.dmp
memory/1172-2862-0x00000295FC670000-0x00000295FC678000-memory.dmp
memory/1172-2846-0x00000295FAA10000-0x00000295FAA32000-memory.dmp
memory/1172-2840-0x00000295FA830000-0x00000295FA840000-memory.dmp
memory/1172-2838-0x00000295FA830000-0x00000295FA840000-memory.dmp
memory/1172-2864-0x00000295FC6B0000-0x00000295FC6BA000-memory.dmp
memory/1172-2863-0x00000295FC6A0000-0x00000295FC6A6000-memory.dmp
memory/1172-2848-0x00000295FA830000-0x00000295FA840000-memory.dmp
memory/1172-2861-0x00000295FC6C0000-0x00000295FC6DA000-memory.dmp
memory/1172-2860-0x00000295FC660000-0x00000295FC66A000-memory.dmp
memory/1172-2859-0x00000295FC680000-0x00000295FC69C000-memory.dmp
memory/1172-2858-0x00000295FC320000-0x00000295FC32A000-memory.dmp
memory/1172-2857-0x00000295FC350000-0x00000295FC403000-memory.dmp
memory/1172-2856-0x00000295FC330000-0x00000295FC34C000-memory.dmp
memory/1172-2849-0x00007FF4139F0000-0x00007FF413A00000-memory.dmp
memory/2436-67-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-41-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-119-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-117-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-113-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-111-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-109-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-107-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-105-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-103-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-101-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-99-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-95-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-93-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-91-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-89-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-87-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-86-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-83-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-81-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-79-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-77-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-97-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-75-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-73-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-71-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-69-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-123-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-65-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-63-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-61-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-59-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-57-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-51-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-49-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-47-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-43-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-121-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-39-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-37-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-35-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-33-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-31-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-29-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-27-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-25-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-21-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-19-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-15-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-13-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-55-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-53-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-45-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-12-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-2833-0x000002DB1C490000-0x000002DB1C4E6000-memory.dmp
memory/2436-2834-0x000002DB1D2C0000-0x000002DB1D30C000-memory.dmp
memory/2436-2835-0x000002DB1DBC0000-0x000002DB1DC14000-memory.dmp
memory/2436-127-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-129-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-131-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-133-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-125-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-115-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-23-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-17-0x000002DB1D1B0000-0x000002DB1D2BA000-memory.dmp
memory/2436-11-0x000002DB1D1B0000-0x000002DB1D2BE000-memory.dmp
memory/2436-10-0x000002DB1C520000-0x000002DB1C530000-memory.dmp
memory/2436-9-0x000002DB03A30000-0x000002DB03ADC000-memory.dmp
memory/2436-8-0x000002DB1C520000-0x000002DB1C530000-memory.dmp
memory/2436-7-0x000002DB02080000-0x000002DB0212F000-memory.dmp
memory/2436-0-0x00007FF7D1E20000-0x00007FF7D1EDD000-memory.dmp
memory/2436-2837-0x000002DB1C520000-0x000002DB1C530000-memory.dmp
memory/2436-2836-0x000002DB1C520000-0x000002DB1C530000-memory.dmp
memory/2436-2839-0x000002DB1C520000-0x000002DB1C530000-memory.dmp