Analysis
- max time kernel
298s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 10:26
General
- Target Invoice_Confirmation_Copy_INV-0826.hta
- Size 1.2MB
- Sample260708-mgv7jset7w
- SHA256 4f74a2b8d5fa11ef561bde59317d517697bd0f09736e56cfd8f3088810b5c5df
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Detects DonutLoader 1 IoCs
- Formbook payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Invoice_Confirmation_Copy_INV-0826.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp658006.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp658006.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp658006.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
tmp658006.bat
tmp658006.bat.gz
Ennnn
vijewyufveonabghulluonouceyasi.exe
wwmaw
memory/3180-49-0x0000000005940000-0x0000000005986000-memory.dmp
memory/3180-46-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3180-45-0x0000000001260000-0x00000000012AE000-memory.dmp
memory/3192-18-0x0000000006F30000-0x0000000006FC6000-memory.dmp
memory/3192-11-0x00000000058A0000-0x0000000005BFB000-memory.dmp
memory/3192-14-0x00000000075B0000-0x0000000007C2C000-memory.dmp
memory/3192-15-0x00000000061D0000-0x00000000061EA000-memory.dmp
memory/3192-12-0x0000000005C70000-0x0000000005C8E000-memory.dmp
memory/3192-1-0x0000000070BF2000-0x0000000070BF3000-memory.dmp
memory/3192-19-0x0000000006280000-0x00000000062A2000-memory.dmp
memory/3192-20-0x0000000007C30000-0x00000000081EA000-memory.dmp
memory/3192-22-0x0000000070BE0000-0x000000007139C000-memory.dmp
memory/3192-13-0x0000000005CB0000-0x0000000005CFC000-memory.dmp
memory/3192-2-0x00000000027C0000-0x00000000027F6000-memory.dmp
memory/3192-9-0x00000000056B0000-0x0000000005716000-memory.dmp
memory/3192-3-0x0000000070BE0000-0x000000007139C000-memory.dmp
memory/3192-10-0x0000000005720000-0x0000000005786000-memory.dmp
memory/3192-6-0x0000000005610000-0x0000000005632000-memory.dmp
memory/3192-5-0x0000000070BE0000-0x000000007139C000-memory.dmp
memory/3192-4-0x0000000004F90000-0x00000000055DA000-memory.dmp
memory/5536-30-0x0000000006220000-0x000000000626C000-memory.dmp
memory/5536-26-0x0000000005C60000-0x0000000005FBB000-memory.dmp