General
- Target Assessment%20Notice.zip
- Size 6.3MB
- Sample260731-gza2faea52
- SHA256 e2db442adb39a41b5db2738a981fc4a6fd5c00769dee6420c4f6d368f6082c8b
Malware Config
Targets
-
- Target 202607303544.exe
- Size 6.3MB
- SHA256 46e22c3febad57d20dfb3b3a349ed43570794edc7a5f80008c3dc5970d84c3b9
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target tedutil.dll
- Size 55KB
- SHA256 cc873c23a5d2eae22dc0268e8c4ea1238313173e8bc0dac4c33283b94ba20b4d
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target tedutil_original.dll
- Size 298KB
- SHA256 02803028ea10dd92e8856c6553fc4ba6b3c09d973f4fc82226bfd2c42f0e6b06
Score5/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1