Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 08:36
General
- Target payment.hta
- Size 1.2MB
- Sample260709-khsrpsft3l
- SHA256 83d11fedaa3da5bd1f1af12a4621570aff442a4df4904e68829d221464ab3880
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\payment.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp303010.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp303010.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp303010.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
tmp303010.bat
tmp303010.bat.gz
Ennnn
vijewyufveonabghulluonouceyasi.exe
wwmaw
memory/1380-30-0x00000000062E0000-0x000000000632C000-memory.dmp
memory/1380-26-0x00000000057D0000-0x0000000005B2B000-memory.dmp
memory/2616-47-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2616-46-0x0000000001200000-0x000000000124E000-memory.dmp
memory/4468-8-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/4468-11-0x0000000005FE0000-0x000000000633B000-memory.dmp
memory/4468-15-0x0000000006980000-0x000000000699A000-memory.dmp
memory/4468-13-0x0000000006470000-0x00000000064BC000-memory.dmp
memory/4468-18-0x0000000007790000-0x0000000007826000-memory.dmp
memory/4468-19-0x0000000007450000-0x0000000007472000-memory.dmp
memory/4468-20-0x00000000089B0000-0x0000000008F6A000-memory.dmp
memory/4468-22-0x00000000708C0000-0x000000007107C000-memory.dmp
memory/4468-12-0x0000000006430000-0x000000000644E000-memory.dmp
memory/4468-14-0x0000000007D70000-0x00000000083EC000-memory.dmp
memory/4468-7-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/4468-1-0x00000000708D2000-0x00000000708D3000-memory.dmp
memory/4468-6-0x0000000005560000-0x0000000005582000-memory.dmp
memory/4468-5-0x00000000708C0000-0x000000007107C000-memory.dmp
memory/4468-3-0x00000000708C0000-0x000000007107C000-memory.dmp
memory/4468-4-0x00000000056A0000-0x0000000005CEA000-memory.dmp
memory/4468-2-0x0000000004F50000-0x0000000004F86000-memory.dmp