Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/07/2026, 22:00
General
- Target apphost (1).exe
- Size 21.2MB
- Sample260705-1w4dcsfz21
- SHA256 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 7 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\apphost (1).exe"C:\Users\Admin\AppData\Local\Temp\apphost (1).exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\apphost.exe"C:\apphost.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
apphost.exe
memory/2900-18-0x000000001FCE0000-0x0000000021106000-memory.dmp
memory/2900-19-0x000000001E8B0000-0x000000001EE58000-memory.dmp
memory/2900-22-0x000000001F760000-0x000000001F97C000-memory.dmp
memory/2900-24-0x0000000005DC0000-0x0000000005DD2000-memory.dmp
memory/4860-0-0x0000000003540000-0x0000000004A7B000-memory.dmp
memory/4860-1-0x000000001ED60000-0x000000001ED70000-memory.dmp
memory/4860-2-0x00000000202B0000-0x00000000217EE000-memory.dmp
memory/4860-4-0x000000001ED60000-0x000000001ED70000-memory.dmp
memory/4860-3-0x000000001ED60000-0x000000001ED70000-memory.dmp
memory/4860-17-0x0000000000400000-0x000000000193F000-memory.dmp