Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/06/2026, 02:04
General
- Target mscorsvc.dll.bin.dll
- Size 757KB
- Sample260620-chpfaacy2j
- SHA256 e58ed7df39ec67a18fd90454d3fde120e57aeb06f7ab8f0b8c17d73e4c3a3ad6
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mscorsvc.dll.bin.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3252-1-0x0000000008650000-0x00000000086FF000-memory.dmp
memory/3252-2-0x0000000002A30000-0x0000000002A31000-memory.dmp
memory/3252-3-0x0000000009360000-0x000000000940C000-memory.dmp
memory/3252-7-0x0000000009810000-0x0000000009820000-memory.dmp
memory/3252-6-0x0000000009810000-0x0000000009820000-memory.dmp
memory/3252-4-0x0000000009810000-0x0000000009820000-memory.dmp
memory/3252-9-0x00000000097A0000-0x0000000009804000-memory.dmp
memory/3252-10-0x0000000009990000-0x0000000009A6A000-memory.dmp
memory/3252-11-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-28-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-132-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-130-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-1889-0x0000000002A60000-0x0000000002A66000-memory.dmp
memory/3252-126-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-118-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-116-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-114-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-108-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-106-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-104-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-102-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-100-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-98-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-96-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-94-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-92-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-88-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-87-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-82-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-80-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-76-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-74-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-72-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-68-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-66-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-64-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-60-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-58-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-56-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-54-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-52-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-50-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-48-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-46-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-44-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-42-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-40-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-38-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-36-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-34-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-32-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-30-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-26-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-25-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-22-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-20-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-134-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-128-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-124-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-122-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-120-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-16-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-112-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-110-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-90-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-14-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-84-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-78-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-70-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-62-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-12-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-18-0x0000000009990000-0x0000000009A65000-memory.dmp
memory/3252-1892-0x0000000009810000-0x0000000009820000-memory.dmp
memory/3252-1893-0x0000000009810000-0x0000000009820000-memory.dmp
memory/3252-1894-0x0000000009810000-0x0000000009820000-memory.dmp
memory/3252-1895-0x0000000009810000-0x0000000009820000-memory.dmp
memory/3252-1896-0x000000000B280000-0x000000000B350000-memory.dmp
memory/3252-4989-0x0000000009810000-0x0000000009820000-memory.dmp