donutloader | 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apphost.exe
Size 21.2MB
Sample260703-vzabssc19t
SHA256 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c
MD5 8e839d4941368d229f0414ada66bb41a
SHA1 1a0db9b358a4e31711c8750fb885b6e5bc47fcfc
SHA512 7ce9b7ddb9d23bdb27ae92a4576ab2a81f7af1d374e0a3aede9457c39b18ecba5f88af0211c43b0de1b08a17ece1d1eba1b7f12d7f985453da1f37429f5e70d0
SSDEEP 393216:cqUuFYYyJ4ZjqITtpRi8TJJEECsfWufTKE06SUuQknLYVe2BSveW:cSFj3R5TJwsXKdHB1LPqW
TLSH
T1682733E503E463ADC196D736696C97052D3F322B4C5B2617E4B8AE0649DA0FCEEF9034
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader loader ransomware

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/2892-0-0x00000000036E0000-0x0000000004C1B000-memory.dmp	family_donutloader

Clears Windows event logs 1 TTPs 30 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
3424	wevtutil.exe
4624	wevtutil.exe
1156	wevtutil.exe
3704	wevtutil.exe
3912	wevtutil.exe
4836	wevtutil.exe
4304	wevtutil.exe
2132	wevtutil.exe
1536	wevtutil.exe
3584	wevtutil.exe
1016	wevtutil.exe
4128	wevtutil.exe
3816	wevtutil.exe
1532	wevtutil.exe
1108	wevtutil.exe
1656	wevtutil.exe
2248	wevtutil.exe
2460	wevtutil.exe
1292	wevtutil.exe
3796	wevtutil.exe
1220	wevtutil.exe
2600	wevtutil.exe
3804	wevtutil.exe
3780	wevtutil.exe
4804	wevtutil.exe
2136	wevtutil.exe
3112	wevtutil.exe
2988	wevtutil.exe
2332	wevtutil.exe
4704	wevtutil.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apphost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	apphost.exe

Executes dropped EXE 1 IoCs

pid	Process
2740	apphost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	apphost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	apphost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	apphost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2892	apphost.exe
2892	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	apphost.exe
Token: SeDebugPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2460	wevtutil.exe
Token: SeBackupPrivilege	2460	wevtutil.exe
Token: SeSecurityPrivilege	3780	wevtutil.exe
Token: SeBackupPrivilege	3780	wevtutil.exe
Token: SeSecurityPrivilege	1016	wevtutil.exe
Token: SeBackupPrivilege	1016	wevtutil.exe
Token: SeSecurityPrivilege	4624	wevtutil.exe
Token: SeBackupPrivilege	4624	wevtutil.exe
Token: SeSecurityPrivilege	1532	wevtutil.exe
Token: SeBackupPrivilege	1532	wevtutil.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	3912	wevtutil.exe
Token: SeBackupPrivilege	3912	wevtutil.exe
Token: SeSecurityPrivilege	2988	wevtutil.exe
Token: SeBackupPrivilege	2988	wevtutil.exe
Token: SeSecurityPrivilege	1292	wevtutil.exe
Token: SeBackupPrivilege	1292	wevtutil.exe
Token: SeSecurityPrivilege	2332	wevtutil.exe
Token: SeBackupPrivilege	2332	wevtutil.exe
Token: SeSecurityPrivilege	3796	wevtutil.exe
Token: SeBackupPrivilege	3796	wevtutil.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	2740	apphost.exe
Token: SeBackupPrivilege	2740	apphost.exe
Token: SeSecurityPrivilege	1156	wevtutil.exe
Token: SeBackupPrivilege	1156	wevtutil.exe
Token: SeSecurityPrivilege	1108	wevtutil.exe
Token: SeBackupPrivilege	1108	wevtutil.exe
Token: SeSecurityPrivilege	4804	wevtutil.exe
Token: SeBackupPrivilege	4804	wevtutil.exe
Token: SeSecurityPrivilege	4128	wevtutil.exe
Token: SeBackupPrivilege	4128	wevtutil.exe
Token: SeSecurityPrivilege	4836	wevtutil.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe
2740	apphost.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2740	2892	apphost.exe	87
PID 2740 wrote to memory of 2460	2740	apphost.exe	97
PID 2740 wrote to memory of 3780	2740	apphost.exe	99
PID 2740 wrote to memory of 1016	2740	apphost.exe	101
PID 2740 wrote to memory of 4624	2740	apphost.exe	103
PID 2740 wrote to memory of 1532	2740	apphost.exe	105
PID 2740 wrote to memory of 3912	2740	apphost.exe	107
PID 2740 wrote to memory of 2988	2740	apphost.exe	109
PID 2740 wrote to memory of 1292	2740	apphost.exe	111
PID 2740 wrote to memory of 2332	2740	apphost.exe	113
PID 2740 wrote to memory of 3796	2740	apphost.exe	115
PID 2740 wrote to memory of 1156	2740	apphost.exe	118
PID 2740 wrote to memory of 1108	2740	apphost.exe	120
PID 2740 wrote to memory of 4804	2740	apphost.exe	122
PID 2740 wrote to memory of 4128	2740	apphost.exe	124
PID 2740 wrote to memory of 4836	2740	apphost.exe	126
PID 2740 wrote to memory of 1656	2740	apphost.exe	128
PID 2740 wrote to memory of 4704	2740	apphost.exe	130
PID 2740 wrote to memory of 2248	2740	apphost.exe	132
PID 2740 wrote to memory of 4304	2740	apphost.exe	134
PID 2740 wrote to memory of 2132	2740	apphost.exe	136
PID 2740 wrote to memory of 3424	2740	apphost.exe	138
PID 2740 wrote to memory of 1220	2740	apphost.exe	140
PID 2740 wrote to memory of 3816	2740	apphost.exe	142
PID 2740 wrote to memory of 3704	2740	apphost.exe	144
PID 2740 wrote to memory of 1536	2740	apphost.exe	146
PID 2740 wrote to memory of 2136	2740	apphost.exe	148
PID 2740 wrote to memory of 2600	2740	apphost.exe	150
PID 2740 wrote to memory of 3804	2740	apphost.exe	152
PID 2740 wrote to memory of 3584	2740	apphost.exe	154
PID 2740 wrote to memory of 3112	2740	apphost.exe	156

C:\Users\Admin\AppData\Local\Temp\apphost.exe
"C:\Users\Admin\AppData\Local\Temp\apphost.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\apphost.exe
  "C:\apphost.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:1656
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:4704
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:2248
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:4304
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:2132
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:3424
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:1220
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:3816
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:3704
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:1536
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:2136
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:2600
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:3804
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:3584
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:3112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apphost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\apphost.exe.log
Size 847B
SHA256 f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8
MD5 66a0a4aa01208ed3d53a5e131a8d030a
SHA1 ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1
SHA512 626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c
TLSH
T193018EB12361F1D589133F461D9C264407FF4728BA50EE1CB5A9625ED9260275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

apphost.exe

Path C:\apphost.exe
Size 20.2MB
SHA256 ecea0d2c076632ef15c6c928bcd324a31e9d404a816b1b887ddcecf6a174905c
MD5 3013f1ab249470ff5f709ecbf3b14326
SHA1 965423fc0f556be813f56bae0a37e2c48caa1bba
SHA512 4aabc9b60eeda03bf908badbd6f9a1ef3669e1b385edcedb9a40158f3e1cb0a38b820ddc3a1ece20dfb7893b95269bd8bc633ccd256fc6ba6883549417ee686f
SSDEEP 393216:D0LGBz8I9xrIj1sKDX8QbJq4BWr3b8tvjuCopk19MouqWBR7Iz0H:4qBtBQbc4orot7uCoijvu7D7Izs
TLSH
T176273306E6A9254DDBCD6D347CB06332622E6280BBFDDD85E3AD1171C6A72EDF643090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2740-19-0x000000001FE30000-0x0000000021256000-memory.dmp

Download

memory/2740-37-0x000000002ADE0000-0x000000002AE1C000-memory.dmp

Download

memory/2740-36-0x000000002ADB0000-0x000000002ADD2000-memory.dmp

Download

memory/2740-25-0x0000000005E30000-0x0000000005E42000-memory.dmp

Download

memory/2740-23-0x000000001F910000-0x000000001FB2C000-memory.dmp

Download

memory/2740-20-0x000000001EA00000-0x000000001EFA8000-memory.dmp

Download

memory/2892-4-0x000000001EBF0000-0x000000001EC00000-memory.dmp

Download

memory/2892-17-0x0000000000400000-0x000000000193F000-memory.dmp

Download

memory/2892-3-0x000000001EBF0000-0x000000001EC00000-memory.dmp

Download

memory/2892-0-0x00000000036E0000-0x0000000004C1B000-memory.dmp

Download

memory/2892-2-0x0000000020140000-0x000000002167E000-memory.dmp

Download

memory/2892-1-0x000000001EBF0000-0x000000001EC00000-memory.dmp

Download