Analysis
- user interaction
yes - max time kernel
126s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/07/2026, 11:17
General
- Target BacteriaTunnels v2.exe
- Size 1.1MB
- Sample260715-nd22cses4v
- SHA256 eb79b9e2dda3dac0fe4d77c776003012eb29009b1b14ed0540f93494be1fd680
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Loads dropped DLL 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BacteriaTunnels v2.exe"C:\Users\Admin\AppData\Local\Temp\BacteriaTunnels v2.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Hydra_he5kmSQWGNkT7rU97l6ybgB38tMlLD0BsfBSDeD5LWd6WRABb7uXT9TBcBm2GpLCWjkbpC5dhBmEDEgq.dll
memory/1776-13-0x000000001C3B0000-0x000000001C45C000-memory.dmp
memory/1776-19-0x0000000002EC0000-0x0000000002EC6000-memory.dmp
memory/1776-1-0x0000000000C60000-0x0000000000D74000-memory.dmp
memory/1776-7-0x0000000003090000-0x000000000317E000-memory.dmp
memory/1776-8-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-9-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-10-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-11-0x000000001BF50000-0x000000001C000000-memory.dmp
memory/1776-12-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-0-0x00007FFD2973F000-0x00007FFD29740000-memory.dmp
memory/1776-3-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-20-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-14-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-21-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-22-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-24-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-23-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-25-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-26-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-27-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp
memory/1776-29-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp