donutloader | 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apphost.exe
Size 21.2MB
Sample260703-vzabssc19t
SHA256 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c
MD5 8e839d4941368d229f0414ada66bb41a
SHA1 1a0db9b358a4e31711c8750fb885b6e5bc47fcfc
SHA512 7ce9b7ddb9d23bdb27ae92a4576ab2a81f7af1d374e0a3aede9457c39b18ecba5f88af0211c43b0de1b08a17ece1d1eba1b7f12d7f985453da1f37429f5e70d0
SSDEEP 393216:cqUuFYYyJ4ZjqITtpRi8TJJEECsfWufTKE06SUuQknLYVe2BSveW:cSFj3R5TJwsXKdHB1LPqW
TLSH
T1682733E503E463ADC196D736696C97052D3F322B4C5B2617E4B8AE0649DA0FCEEF9034
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader loader ransomware

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2068-0-0x0000000003710000-0x0000000004C4B000-memory.dmp	family_donutloader

Clears Windows event logs 1 TTPs 30 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2056	wevtutil.exe
4944	wevtutil.exe
4476	wevtutil.exe
5184	wevtutil.exe
2808	wevtutil.exe
1496	wevtutil.exe
6052	wevtutil.exe
3268	wevtutil.exe
5660	wevtutil.exe
4440	wevtutil.exe
5200	wevtutil.exe
2772	wevtutil.exe
3144	wevtutil.exe
4312	wevtutil.exe
1368	wevtutil.exe
3928	wevtutil.exe
4156	wevtutil.exe
3920	wevtutil.exe
4396	wevtutil.exe
424	wevtutil.exe
5904	wevtutil.exe
3000	wevtutil.exe
3820	wevtutil.exe
4060	wevtutil.exe
4760	wevtutil.exe
2888	wevtutil.exe
5836	wevtutil.exe
5412	wevtutil.exe
4936	wevtutil.exe
2168	wevtutil.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apphost.exe

Executes dropped EXE 1 IoCs

pid	Process
944	apphost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	apphost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	apphost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	apphost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2068	apphost.exe
2068	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe
944	apphost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	apphost.exe
Token: SeDebugPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	5904	wevtutil.exe
Token: SeBackupPrivilege	5904	wevtutil.exe
Token: SeSecurityPrivilege	4476	wevtutil.exe
Token: SeBackupPrivilege	4476	wevtutil.exe
Token: SeSecurityPrivilege	5184	wevtutil.exe
Token: SeBackupPrivilege	5184	wevtutil.exe
Token: SeSecurityPrivilege	3000	wevtutil.exe
Token: SeBackupPrivilege	3000	wevtutil.exe
Token: SeSecurityPrivilege	2808	wevtutil.exe
Token: SeBackupPrivilege	2808	wevtutil.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	1496	wevtutil.exe
Token: SeBackupPrivilege	1496	wevtutil.exe
Token: SeSecurityPrivilege	4440	wevtutil.exe
Token: SeBackupPrivilege	4440	wevtutil.exe
Token: SeSecurityPrivilege	3820	wevtutil.exe
Token: SeBackupPrivilege	3820	wevtutil.exe
Token: SeSecurityPrivilege	4060	wevtutil.exe
Token: SeBackupPrivilege	4060	wevtutil.exe
Token: SeSecurityPrivilege	6052	wevtutil.exe
Token: SeBackupPrivilege	6052	wevtutil.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	4760	wevtutil.exe
Token: SeBackupPrivilege	4760	wevtutil.exe
Token: SeSecurityPrivilege	1368	wevtutil.exe
Token: SeBackupPrivilege	1368	wevtutil.exe
Token: SeSecurityPrivilege	4944	wevtutil.exe
Token: SeBackupPrivilege	4944	wevtutil.exe
Token: SeSecurityPrivilege	3268	wevtutil.exe
Token: SeBackupPrivilege	3268	wevtutil.exe
Token: SeSecurityPrivilege	3928	wevtutil.exe
Token: SeBackupPrivilege	3928	wevtutil.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeBackupPrivilege	944	apphost.exe
Token: SeSecurityPrivilege	944	apphost.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 944	2068	apphost.exe	88
PID 944 wrote to memory of 5904	944	apphost.exe	90
PID 944 wrote to memory of 4476	944	apphost.exe	92
PID 944 wrote to memory of 5184	944	apphost.exe	94
PID 944 wrote to memory of 3000	944	apphost.exe	96
PID 944 wrote to memory of 2808	944	apphost.exe	98
PID 944 wrote to memory of 1496	944	apphost.exe	100
PID 944 wrote to memory of 4440	944	apphost.exe	102
PID 944 wrote to memory of 3820	944	apphost.exe	104
PID 944 wrote to memory of 4060	944	apphost.exe	106
PID 944 wrote to memory of 6052	944	apphost.exe	108
PID 944 wrote to memory of 4760	944	apphost.exe	110
PID 944 wrote to memory of 1368	944	apphost.exe	112
PID 944 wrote to memory of 4944	944	apphost.exe	114
PID 944 wrote to memory of 3268	944	apphost.exe	116
PID 944 wrote to memory of 3928	944	apphost.exe	118
PID 944 wrote to memory of 2888	944	apphost.exe	120
PID 944 wrote to memory of 5836	944	apphost.exe	122
PID 944 wrote to memory of 5412	944	apphost.exe	124
PID 944 wrote to memory of 3920	944	apphost.exe	126
PID 944 wrote to memory of 2056	944	apphost.exe	128
PID 944 wrote to memory of 4936	944	apphost.exe	130
PID 944 wrote to memory of 2168	944	apphost.exe	132
PID 944 wrote to memory of 5200	944	apphost.exe	134
PID 944 wrote to memory of 4156	944	apphost.exe	136
PID 944 wrote to memory of 4396	944	apphost.exe	138
PID 944 wrote to memory of 424	944	apphost.exe	140
PID 944 wrote to memory of 2772	944	apphost.exe	142
PID 944 wrote to memory of 5660	944	apphost.exe	144
PID 944 wrote to memory of 3144	944	apphost.exe	146
PID 944 wrote to memory of 4312	944	apphost.exe	148

C:\Users\Admin\AppData\Local\Temp\apphost.exe
"C:\Users\Admin\AppData\Local\Temp\apphost.exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\apphost.exe
  "C:\apphost.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:5904
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1368
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:2888
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:5836
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:5412
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:3920
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:2056
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:4936
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:2168
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:5200
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:4156
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:4396
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:424
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:2772
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:5660
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:3144
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apphost.exe

Path C:\apphost.exe
Size 20.2MB
SHA256 ecea0d2c076632ef15c6c928bcd324a31e9d404a816b1b887ddcecf6a174905c
MD5 3013f1ab249470ff5f709ecbf3b14326
SHA1 965423fc0f556be813f56bae0a37e2c48caa1bba
SHA512 4aabc9b60eeda03bf908badbd6f9a1ef3669e1b385edcedb9a40158f3e1cb0a38b820ddc3a1ece20dfb7893b95269bd8bc633ccd256fc6ba6883549417ee686f
SSDEEP 393216:D0LGBz8I9xrIj1sKDX8QbJq4BWr3b8tvjuCopk19MouqWBR7Iz0H:4qBtBQbc4orot7uCoijvu7D7Izs
TLSH
T176273306E6A9254DDBCD6D347CB06332622E6280BBFDDD85E3AD1171C6A72EDF643090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-44-0x000000002C200000-0x000000002C23C000-memory.dmp

Download

memory/944-43-0x0000000034400000-0x0000000034422000-memory.dmp

Download

memory/944-32-0x0000000006010000-0x0000000006022000-memory.dmp

Download

memory/944-30-0x000000001F950000-0x000000001FB6C000-memory.dmp

Download

memory/944-25-0x000000001EA60000-0x000000001F008000-memory.dmp

Download

memory/944-24-0x000000001FE90000-0x00000000212B6000-memory.dmp

Download

memory/2068-5-0x00000000201D0000-0x000000002170E000-memory.dmp

Download

memory/2068-6-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-9-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-10-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-7-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-19-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-20-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-8-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-0-0x0000000003710000-0x0000000004C4B000-memory.dmp

Download

memory/2068-27-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-26-0x0000000000400000-0x000000000193F000-memory.dmp

Download

memory/2068-4-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-3-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-2-0x00007FFD27AC0000-0x00007FFD28464000-memory.dmp

Download

memory/2068-1-0x00007FFD27C4F000-0x00007FFD27C50000-memory.dmp

Download