donutloader | 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apphost (1).exe
Size 21.2MB
Sample260705-1w4dcsfz21
SHA256 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c
MD5 8e839d4941368d229f0414ada66bb41a
SHA1 1a0db9b358a4e31711c8750fb885b6e5bc47fcfc
SHA512 7ce9b7ddb9d23bdb27ae92a4576ab2a81f7af1d374e0a3aede9457c39b18ecba5f88af0211c43b0de1b08a17ece1d1eba1b7f12d7f985453da1f37429f5e70d0
SSDEEP 393216:cqUuFYYyJ4ZjqITtpRi8TJJEECsfWufTKE06SUuQknLYVe2BSveW:cSFj3R5TJwsXKdHB1LPqW
TLSH
T1682733E503E463ADC196D736696C97052D3F322B4C5B2617E4B8AE0649DA0FCEEF9034
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader loader ransomware

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/6156-0-0x00000000038F0000-0x0000000004E2B000-memory.dmp	family_donutloader

Clears Windows event logs 1 TTPs 30 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
7012	wevtutil.exe
5140	wevtutil.exe
3424	wevtutil.exe
612	wevtutil.exe
6844	wevtutil.exe
2808	wevtutil.exe
3536	wevtutil.exe
3956	wevtutil.exe
1720	wevtutil.exe
2412	wevtutil.exe
4896	wevtutil.exe
996	wevtutil.exe
6924	wevtutil.exe
6968	wevtutil.exe
2884	wevtutil.exe
1436	wevtutil.exe
6872	wevtutil.exe
4296	wevtutil.exe
6436	wevtutil.exe
2184	wevtutil.exe
5264	wevtutil.exe
7104	wevtutil.exe
4956	wevtutil.exe
4168	wevtutil.exe
864	wevtutil.exe
2620	wevtutil.exe
2348	wevtutil.exe
2212	wevtutil.exe
6268	wevtutil.exe
2532	wevtutil.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apphost (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apphost.exe

Executes dropped EXE 1 IoCs

pid	Process
6220	apphost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	apphost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	apphost (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	apphost (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	apphost (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	apphost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6156	apphost (1).exe
6156	apphost (1).exe
6156	apphost (1).exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe
6220	apphost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6156	apphost (1).exe
Token: SeDebugPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	2808	wevtutil.exe
Token: SeBackupPrivilege	2808	wevtutil.exe
Token: SeSecurityPrivilege	6872	wevtutil.exe
Token: SeBackupPrivilege	6872	wevtutil.exe
Token: SeSecurityPrivilege	4296	wevtutil.exe
Token: SeBackupPrivilege	4296	wevtutil.exe
Token: SeSecurityPrivilege	4896	wevtutil.exe
Token: SeBackupPrivilege	4896	wevtutil.exe
Token: SeSecurityPrivilege	4956	wevtutil.exe
Token: SeBackupPrivilege	4956	wevtutil.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	2348	wevtutil.exe
Token: SeBackupPrivilege	2348	wevtutil.exe
Token: SeSecurityPrivilege	996	wevtutil.exe
Token: SeBackupPrivilege	996	wevtutil.exe
Token: SeSecurityPrivilege	3536	wevtutil.exe
Token: SeBackupPrivilege	3536	wevtutil.exe
Token: SeSecurityPrivilege	6924	wevtutil.exe
Token: SeBackupPrivilege	6924	wevtutil.exe
Token: SeSecurityPrivilege	6968	wevtutil.exe
Token: SeBackupPrivilege	6968	wevtutil.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	7012	wevtutil.exe
Token: SeBackupPrivilege	7012	wevtutil.exe
Token: SeSecurityPrivilege	4168	wevtutil.exe
Token: SeBackupPrivilege	4168	wevtutil.exe
Token: SeSecurityPrivilege	2184	wevtutil.exe
Token: SeBackupPrivilege	2184	wevtutil.exe
Token: SeSecurityPrivilege	6436	wevtutil.exe
Token: SeBackupPrivilege	6436	wevtutil.exe
Token: SeSecurityPrivilege	2884	wevtutil.exe
Token: SeBackupPrivilege	2884	wevtutil.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeBackupPrivilege	6220	apphost.exe
Token: SeSecurityPrivilege	6220	apphost.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 6156 wrote to memory of 6220	6156	apphost (1).exe	89
PID 6220 wrote to memory of 2808	6220	apphost.exe	90
PID 6220 wrote to memory of 6872	6220	apphost.exe	92
PID 6220 wrote to memory of 4296	6220	apphost.exe	94
PID 6220 wrote to memory of 4896	6220	apphost.exe	96
PID 6220 wrote to memory of 4956	6220	apphost.exe	98
PID 6220 wrote to memory of 2348	6220	apphost.exe	101
PID 6220 wrote to memory of 996	6220	apphost.exe	103
PID 6220 wrote to memory of 3536	6220	apphost.exe	105
PID 6220 wrote to memory of 6924	6220	apphost.exe	107
PID 6220 wrote to memory of 6968	6220	apphost.exe	109
PID 6220 wrote to memory of 7012	6220	apphost.exe	111
PID 6220 wrote to memory of 4168	6220	apphost.exe	113
PID 6220 wrote to memory of 2184	6220	apphost.exe	115
PID 6220 wrote to memory of 6436	6220	apphost.exe	117
PID 6220 wrote to memory of 2884	6220	apphost.exe	119
PID 6220 wrote to memory of 5264	6220	apphost.exe	121
PID 6220 wrote to memory of 5140	6220	apphost.exe	123
PID 6220 wrote to memory of 3956	6220	apphost.exe	125
PID 6220 wrote to memory of 864	6220	apphost.exe	127
PID 6220 wrote to memory of 3424	6220	apphost.exe	129
PID 6220 wrote to memory of 2212	6220	apphost.exe	131
PID 6220 wrote to memory of 612	6220	apphost.exe	133
PID 6220 wrote to memory of 1436	6220	apphost.exe	135
PID 6220 wrote to memory of 6268	6220	apphost.exe	137
PID 6220 wrote to memory of 2620	6220	apphost.exe	139
PID 6220 wrote to memory of 1720	6220	apphost.exe	141
PID 6220 wrote to memory of 2532	6220	apphost.exe	143
PID 6220 wrote to memory of 7104	6220	apphost.exe	145
PID 6220 wrote to memory of 6844	6220	apphost.exe	147
PID 6220 wrote to memory of 2412	6220	apphost.exe	149

C:\Users\Admin\AppData\Local\Temp\apphost (1).exe
"C:\Users\Admin\AppData\Local\Temp\apphost (1).exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6156
- C:\apphost.exe
  "C:\apphost.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6220
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:6872
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:6924
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:6968
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:7012
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:6436
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:5264
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:5140
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:3956
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:864
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:3424
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:2212
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:612
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:1436
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:6268
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:2620
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    PID:1720
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:2532
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    PID:7104
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    PID:6844
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apphost.exe

Path C:\apphost.exe
Size 20.2MB
SHA256 ecea0d2c076632ef15c6c928bcd324a31e9d404a816b1b887ddcecf6a174905c
MD5 3013f1ab249470ff5f709ecbf3b14326
SHA1 965423fc0f556be813f56bae0a37e2c48caa1bba
SHA512 4aabc9b60eeda03bf908badbd6f9a1ef3669e1b385edcedb9a40158f3e1cb0a38b820ddc3a1ece20dfb7893b95269bd8bc633ccd256fc6ba6883549417ee686f
SSDEEP 393216:D0LGBz8I9xrIj1sKDX8QbJq4BWr3b8tvjuCopk19MouqWBR7Iz0H:4qBtBQbc4orot7uCoijvu7D7Izs
TLSH
T176273306E6A9254DDBCD6D347CB06332622E6280BBFDDD85E3AD1171C6A72EDF643090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6156-11-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-10-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-3-0x0000000020210000-0x000000002174E000-memory.dmp

Download

memory/6156-4-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-5-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-6-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-7-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-8-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-9-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-0-0x00000000038F0000-0x0000000004E2B000-memory.dmp

Download

memory/6156-2-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-1-0x00007FFD62F50000-0x00007FFD62F51000-memory.dmp

Download

memory/6156-12-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6156-24-0x0000000000400000-0x000000000193F000-memory.dmp

Download

memory/6156-26-0x00007FFD62DC0000-0x00007FFD63764000-memory.dmp

Download

memory/6220-25-0x000000001FE90000-0x00000000212B6000-memory.dmp

Download

memory/6220-27-0x000000001EA60000-0x000000001F008000-memory.dmp

Download

memory/6220-30-0x000000001F9D0000-0x000000001FBEC000-memory.dmp

Download

memory/6220-32-0x000000001E9D0000-0x000000001E9E2000-memory.dmp

Download

memory/6220-43-0x000000002C400000-0x000000002C422000-memory.dmp

Download

memory/6220-44-0x000000002C430000-0x000000002C46C000-memory.dmp

Download