Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 21:08
General
- Target 9b578e423a61209c8818391be449dc1b69a9a8cb64bf53e3c80e868437de6c88.exe
- Size 887KB
- Sample260604-zzdrfafy2k
- SHA256 9b578e423a61209c8818391be449dc1b69a9a8cb64bf53e3c80e868437de6c88
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b578e423a61209c8818391be449dc1b69a9a8cb64bf53e3c80e868437de6c88.exe"C:\Users\Admin\AppData\Local\Temp\9b578e423a61209c8818391be449dc1b69a9a8cb64bf53e3c80e868437de6c88.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\px2xoqqik30\rcbqexjm4r.vbs"2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rcbqexjm4r\rcbqexjm4r.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rcbqexjm4r\0ltrwyd5dt.xml"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\scbh3g2q\scbh3g2q.cmdline"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1539.tmp" "c:\Users\Admin\AppData\Local\Temp\scbh3g2q\CSC6D783C719A204E8F9FD6A3D827E1B1DE.TMP"6⤵
-
-
-
-
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES1539.tmp
0ltrwyd5dt.cs
0ltrwyd5dt.vbs
0ltrwyd5dt.xml
aes_iv.bin
aes_key.bin
config.txt
payload_encrypted.bin
rcbqexjm4r.vbs
scbh3g2q.dll
scbh3g2q.pdb
CSC6D783C719A204E8F9FD6A3D827E1B1DE.TMP
scbh3g2q.0.cs
scbh3g2q.cmdline
memory/3052-36-0x0000000005220000-0x000000000537A000-memory.dmp
memory/3052-34-0x00000000005C0000-0x0000000000600000-memory.dmp
memory/3052-41-0x00000000060C0000-0x000000000623C000-memory.dmp
memory/3052-40-0x0000000005D80000-0x0000000005DC4000-memory.dmp
memory/3052-39-0x0000000005E60000-0x0000000005F82000-memory.dmp
memory/3052-37-0x00000000050F0000-0x0000000005120000-memory.dmp
memory/3052-35-0x0000000004FC0000-0x0000000004FDA000-memory.dmp
memory/3052-42-0x0000000006430000-0x0000000006796000-memory.dmp
memory/3052-58-0x0000000005D40000-0x0000000005D48000-memory.dmp
memory/3052-62-0x0000000005DD0000-0x0000000005E38000-memory.dmp
memory/3052-63-0x0000000006130000-0x0000000006196000-memory.dmp
memory/3052-64-0x00000000064A0000-0x00000000064F0000-memory.dmp
memory/3052-65-0x00000000064F0000-0x00000000065AE000-memory.dmp
memory/3052-66-0x00000000066D0000-0x0000000006736000-memory.dmp