donutloader | dabcaca3aa35461871f01b9ff153347a0b28350ae7c3e5d5c1c4ec7f3a64a8d8

General

Target
sssssss.exe
Size 1.6MB
Sample260712-vrv9asd17m
SHA256 dabcaca3aa35461871f01b9ff153347a0b28350ae7c3e5d5c1c4ec7f3a64a8d8
MD5 420729f6f646381d0e8500e2e2152d0b
SHA1 aa60cdfa00e66ff501a127500d289492fa8ae791
SHA512 feff9deda269b2f28808148e137c6a93c06597591f06f93cf6a50f8c255139dcd31e274d7a5c8dd015a60a0732ab5727dc27c302357fb3a22214324318af764f
SSDEEP 49152:jox0A92TQ2Kw9BXNnYPKg6wF42Y58ymlAl:jyhGBpYPbk537l
TLSH
T1F88533461BB8C1F3DF9234F65429FC545F7B9A1570E0018E7298E9631C2E29BCA3EE64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  sssssss.exe
- Size 1.6MB
- SHA256 dabcaca3aa35461871f01b9ff153347a0b28350ae7c3e5d5c1c4ec7f3a64a8d8
- MD5 420729f6f646381d0e8500e2e2152d0b
- SHA1 aa60cdfa00e66ff501a127500d289492fa8ae791
- SHA512 feff9deda269b2f28808148e137c6a93c06597591f06f93cf6a50f8c255139dcd31e274d7a5c8dd015a60a0732ab5727dc27c302357fb3a22214324318af764f
- SSDEEP 49152:jox0A92TQ2Kw9BXNnYPKg6wF42Y58ymlAl:jyhGBpYPbk537l
- TLSH
  T1F88533461BB8C1F3DF9234F65429FC545F7B9A1570E0018E7298E9631C2E29BCA3EE64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion execution donutloader loader persistence
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1