Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 19:16
General
- Target patch_8u9iyg.bat
- Size 1.0MB
- Sample260724-xyydcabm6w
- SHA256 6945303eb8b013ae5eaaa2071899c50400aed9f7465a2c80802b9d315858a450
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs
Payload decoded via CertUtil.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\patch_8u9iyg.bat"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\patch_8u9iyg.bat"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -decode "C:\Users\Admin\AppData\Local\Temp\gfafn.b64" "C:\Users\Admin\AppData\Local\Temp\usbmon_8u9iyg.dll"4⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Windows\system32\certutil.execertutil -decode "C:\Users\Admin\AppData\Local\Temp\hcmci.b64" "C:\Users\Admin\AppData\Local\Temp\own.enc"4⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\usbmon_8u9iyg.dll",Run4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\PING.EXEping -n 5 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gfafn.b64
gfafn.b64
hcmci.b64
hcmci.b64
hcmci.b64
memory/2808-4894-0x00007FF91AE00000-0x00007FF91AE0D000-memory.dmp
memory/5116-4888-0x0000000005A70000-0x0000000005B20000-memory.dmp
memory/5116-4890-0x0000000006140000-0x00000000061F0000-memory.dmp
memory/5116-4891-0x0000000006500000-0x00000000065EA000-memory.dmp
memory/5116-4895-0x0000000008EA0000-0x0000000008F24000-memory.dmp
memory/5116-4905-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4899-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4897-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4896-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4903-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5017-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5015-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5013-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5007-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5003-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5001-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4997-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4995-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4993-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4991-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4985-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4983-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4981-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4979-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4977-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4975-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4973-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4971-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4969-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4965-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4963-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4961-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4959-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4957-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4955-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4953-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4951-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4949-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4945-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4943-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4941-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4939-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4937-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4935-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4933-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4931-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4929-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4927-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4925-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4923-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4921-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4919-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4917-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4913-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4911-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4909-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4907-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4901-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5011-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5010-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-5005-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4999-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4988-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4989-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4967-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4948-0x0000000008EA0000-0x0000000008F1E000-memory.dmp
memory/5116-4915-0x0000000008EA0000-0x0000000008F1E000-memory.dmp