donutloader | c3fb5c5081aba77584c46a30d10661304960c063f3cee80cecca956b8270bee0

General

Target
XWormV3.0.exe
Size 7.3MB
Sample260628-d4j85aez9n
SHA256 c3fb5c5081aba77584c46a30d10661304960c063f3cee80cecca956b8270bee0
MD5 e5dc7c85355e3095f4e9a2e7719e8c18
SHA1 fb45f288d77d435943b719f5d44b8b743439dd9f
SHA512 3c318318792b7a47cc076714a8049a374184b4a7c4e260fa892952e6cfb81c8cb7c0d2f8271375c5f8b45245333cfd9d9998a0c4e166a92cb235063d5c49d654
SSDEEP 196608:nupH1QhyrMfCbM9vtEMmQo/6gkK4EfZKnlOeSiLQ:KKhyQWetyQaiK4yInozt
TLSH
T12876334058620783E52C693D6E45CD742BF6DC7667A1CB99FCDA3EB3FEB20C54428889
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  XWormV3.0.exe
- Size 7.3MB
- SHA256 c3fb5c5081aba77584c46a30d10661304960c063f3cee80cecca956b8270bee0
- MD5 e5dc7c85355e3095f4e9a2e7719e8c18
- SHA1 fb45f288d77d435943b719f5d44b8b743439dd9f
- SHA512 3c318318792b7a47cc076714a8049a374184b4a7c4e260fa892952e6cfb81c8cb7c0d2f8271375c5f8b45245333cfd9d9998a0c4e166a92cb235063d5c49d654
- SSDEEP 196608:nupH1QhyrMfCbM9vtEMmQo/6gkK4EfZKnlOeSiLQ:KKhyQWetyQaiK4yInozt
- TLSH
  T12876334058620783E52C693D6E45CD742BF6DC7667A1CB99FCDA3EB3FEB20C54428889
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion execution donutloader loader persistence adware ransomware spyware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2