donutloader | f229110a8ce72df3333da92319ced4ecea6cca69fb4bb72dc00cebcd21261d89

General

Target
cscript (1)_Slayed-cleaned.exe
Size 1.9MB
Sample260812-mlxaea11hv
SHA256 f229110a8ce72df3333da92319ced4ecea6cca69fb4bb72dc00cebcd21261d89
MD5 1f6792dc8aa1434240622f3b420d804c
SHA1 1b5b1c70867e69cdc7dea27d3668582b02a9bc66
SHA512 40b94db189c24e8b61e991e370d04e70d980ee6ce61821778082307d07a4d985fbea1c56c2ed4f562e95f4f380879ce71eb8ae89c521bcd337acab04ec409938
SSDEEP 24576:e0x/tf5xU7agj/XtZSQ3mDvtL7gwuloLQuHDacVvk9Sgl8Rz:jx/tf4lrTFylhjactTgl8F
TLSH
T100958C2439FB501AB273EFA54BE4B9EADA6FB6333B076469109103864723D41DDC163E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  cscript (1)_Slayed-cleaned.exe
- Size 1.9MB
- SHA256 f229110a8ce72df3333da92319ced4ecea6cca69fb4bb72dc00cebcd21261d89
- MD5 1f6792dc8aa1434240622f3b420d804c
- SHA1 1b5b1c70867e69cdc7dea27d3668582b02a9bc66
- SHA512 40b94db189c24e8b61e991e370d04e70d980ee6ce61821778082307d07a4d985fbea1c56c2ed4f562e95f4f380879ce71eb8ae89c521bcd337acab04ec409938
- SSDEEP 24576:e0x/tf5xU7agj/XtZSQ3mDvtL7gwuloLQuHDacVvk9Sgl8Rz:jx/tf4lrTFylhjactTgl8F
- TLSH
  T100958C2439FB501AB273EFA54BE4B9EADA6FB6333B076469109103864723D41DDC163E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion execution persistence donutloader loader
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2