General
- Target Vkbgfdw_protected.msi
- Size 1.1MB
- Sample260625-ta57hadv5j
- SHA256 1b9a6e79fa9d38cd11e9ffec2010bcaa14876860be5bec264718c949ed671764
Score
10/10
Malware Config
Targets
-
- Target Vkbgfdw_protected.msi
- Size 1.1MB
- SHA256 1b9a6e79fa9d38cd11e9ffec2010bcaa14876860be5bec264718c949ed671764
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Defense Evasion
System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1