Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
23/06/2026, 19:02
General
- Target SHELL.exe
- Size 48.6MB
- Sample260623-xp2dmsfx2x
- SHA256 7de2483d97a87d347b12c0efb2b9f8c7c736f55bf40b6372aaf9d8851f6f27db
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHELL.exe"C:\Users\Admin\AppData\Local\Temp\SHELL.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xiijqjvq\xiijqjvq.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3961.tmp" "c:\Users\Admin\AppData\Local\Temp\xiijqjvq\CSCC1262758C3384D6880C92B8558952351.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RES3961.tmp
xiijqjvq.dll
CSCC1262758C3384D6880C92B8558952351.TMP
xiijqjvq.0.cs
xiijqjvq.cmdline
memory/6076-9-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-19-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-0-0x00007FFF7666F000-0x00007FFF76670000-memory.dmp
memory/6076-10-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-11-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-12-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-13-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-14-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-15-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-16-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-17-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-18-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-20-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-8-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-21-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-7-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-6-0x000000001E8F0000-0x000000001E912000-memory.dmp
memory/6076-3-0x0000000000D50000-0x0000000003DE8000-memory.dmp
memory/6076-2-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-1-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-34-0x000000001E110000-0x000000001E118000-memory.dmp
memory/6076-35-0x00000000381F0000-0x0000000038A07000-memory.dmp
memory/6076-36-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp
memory/6076-37-0x00000000381F0000-0x0000000038A07000-memory.dmp
memory/6076-38-0x00007FFF764E0000-0x00007FFF76E84000-memory.dmp