General
- Target svchost.exe
- Size 106KB
- Sample260701-zbezlaf16w
- SHA256 e835d0935db86bed726c54cf3c36b06ac1434b6c8098a6848408c6d32381ce6d
Score
10/10
Malware Config
Targets
-
- Target svchost.exe
- Size 106KB
- SHA256 e835d0935db86bed726c54cf3c36b06ac1434b6c8098a6848408c6d32381ce6d
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Looks for VirtualBox Guest Additions in registry
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1