Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 23:53
General
- Target Service.exe
- Size 7.0MB
- Sample260808-3xgbbseq4y
- SHA256 1c8e44fe1340d2251b39ae1ff641d253cc1eb5e7f81cbf84eb5125fb021c47e6
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 2 IoCs
- Stops running service(s) 4 TTPs
- Drops file in System32 directory 3 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
- Modifies data under HKEY_USERS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Service.exe"C:\Users\Admin\AppData\Local\Temp\Service.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Service.exe"C:\Windows\System32\Service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exe"sc.exe" stop Service3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" delete Service3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" create Service binPath= "C:\Windows\System32\Service.exe /service" type= own start= auto3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" description Service "Windows Security Update Service"3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" failure Service reset= 3600 actions= restart/100003⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" start Service3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\Service.exeC:\Windows\SysWOW64\Service.exe /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Service.exe.log
Service.exe
memory/864-0-0x0000000000B70000-0x000000000127C000-memory.dmp
memory/864-1-0x0000000005D80000-0x0000000005D90000-memory.dmp
memory/1692-16-0x0000000005CA0000-0x0000000005CB0000-memory.dmp
memory/2076-18-0x0000000004AC0000-0x0000000004AE2000-memory.dmp
memory/2076-19-0x00000000061F0000-0x00000000062A4000-memory.dmp
memory/2076-20-0x00000000077E0000-0x0000000007892000-memory.dmp
memory/2076-21-0x0000000008240000-0x00000000082D2000-memory.dmp
memory/2076-22-0x0000000008380000-0x000000000841C000-memory.dmp
memory/2076-27-0x00000000052E0000-0x0000000005346000-memory.dmp
memory/2076-28-0x000000000A560000-0x000000000AB04000-memory.dmp