Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 02:01
General
- Target mscorsvc.dll.bin.dll
- Size 757KB
- Sample260620-cfmtnsdz6w
- SHA256 e58ed7df39ec67a18fd90454d3fde120e57aeb06f7ab8f0b8c17d73e4c3a3ad6
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 41 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mscorsvc.dll.bin.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3460-0-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/3460-1-0x00000000038A0000-0x000000000394F000-memory.dmp
memory/3460-2-0x00007FFD2B45F000-0x00007FFD2B460000-memory.dmp
memory/3460-3-0x0000000008BA0000-0x0000000008C4C000-memory.dmp
memory/3460-5-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp
memory/3460-6-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp
memory/3460-7-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp
memory/3460-8-0x0000000008D50000-0x0000000008DB4000-memory.dmp
memory/3460-21-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-148-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-1889-0x00000000035B0000-0x00000000035B6000-memory.dmp
memory/3460-1890-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp
memory/3460-146-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-1891-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp
memory/3460-140-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-124-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-102-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-93-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-144-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-142-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-138-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-136-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-134-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-132-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-130-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-128-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-122-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-121-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-118-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-116-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-114-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-112-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-110-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-108-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-104-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-101-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-99-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-95-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-91-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-89-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-86-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-85-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-82-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-81-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-66-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-59-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-57-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-55-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-53-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-51-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-49-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-45-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-43-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-41-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-40-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-38-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-36-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-34-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-32-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-30-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-23-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-20-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-18-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-15-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-13-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-126-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-11-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-10-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-106-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-77-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-78-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-61-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp
memory/3460-47-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-28-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-26-0x0000000008DE0000-0x0000000008EB5000-memory.dmp
memory/3460-9-0x0000000008DE0000-0x0000000008EBA000-memory.dmp
memory/3460-1892-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp
memory/3460-1893-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp
memory/3460-1894-0x0000000009CA0000-0x0000000009D70000-memory.dmp
memory/3460-4987-0x00007FFD2B2D0000-0x00007FFD2BC74000-memory.dmp