Analysis
- max time kernel
149s - max time network
75s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/07/2026, 03:33
General
- Target PO-ASM202503001.bat
- Size 1.2MB
- Sample260714-d39sdsdv4m
- SHA256 f1006fb5852089095a03be3b1900806b946c8f8d2b5f2c515cd42b1c51ffe0a0
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO-ASM202503001.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charmap.exeC:\Windows\Syswow64\charmap.exe2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Ennnn
vijewyufveonabghulluonouceyasi.exe
wwmaw
memory/1420-14-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-16-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-9-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-10-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-11-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-12-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-13-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-2-0x00007FFB78BCF000-0x00007FFB78BD0000-memory.dmp
memory/1420-15-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-8-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-17-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-18-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-19-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-20-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-7-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-6-0x0000019A9B9C0000-0x0000019A9B9E2000-memory.dmp
memory/1420-5-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/1420-34-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/3068-35-0x00000000012E0000-0x000000000132E000-memory.dmp
memory/3068-37-0x0000000000400000-0x0000000000446000-memory.dmp