Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 02:04
General
- Target mscorsvc.dll.bin.dll
- Size 757KB
- Sample260620-chpfaacy2j
- SHA256 e58ed7df39ec67a18fd90454d3fde120e57aeb06f7ab8f0b8c17d73e4c3a3ad6
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 39 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mscorsvc.dll.bin.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3756-0-0x0000000001360000-0x0000000001361000-memory.dmp
memory/3756-1-0x0000000003A10000-0x0000000003ABF000-memory.dmp
memory/3756-2-0x00007FF9A2CBF000-0x00007FF9A2CC0000-memory.dmp
memory/3756-3-0x0000000008E80000-0x0000000008F2C000-memory.dmp
memory/3756-5-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp
memory/3756-6-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp
memory/3756-7-0x0000000007E70000-0x0000000007ED4000-memory.dmp
memory/3756-9-0x0000000009080000-0x000000000915A000-memory.dmp
memory/3756-8-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp
memory/3756-40-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-38-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-36-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-34-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-32-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-30-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-26-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-24-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-22-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-20-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-19-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-47-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-16-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-15-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-142-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-141-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-138-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-116-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-76-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-75-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-12-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-45-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-1890-0x0000000003530000-0x0000000003536000-memory.dmp
memory/3756-1891-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp
memory/3756-780-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp
memory/3756-69-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-60-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-154-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-151-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-144-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-136-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-133-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-130-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-127-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-124-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-121-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-119-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-114-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-112-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-109-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-106-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-104-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-102-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-101-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-99-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-97-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-94-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-93-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-91-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-88-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-86-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-84-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-83-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-80-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-78-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-72-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-70-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-67-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-62-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-59-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-57-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-54-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-52-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-50-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-48-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-10-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp
memory/3756-11-0x0000000009080000-0x0000000009155000-memory.dmp
memory/3756-1892-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp
memory/3756-1893-0x00007FF9A2B30000-0x00007FF9A34D4000-memory.dmp
memory/3756-1894-0x000000000A260000-0x000000000A330000-memory.dmp