donutloader | 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apphost.exe
Size 21.2MB
Sample260816-rr2vaszdrd
SHA256 7968508cc341b79e15e95a89b3464d470c3ba3410d7dd37eaf854125f82ffb4c
MD5 8e839d4941368d229f0414ada66bb41a
SHA1 1a0db9b358a4e31711c8750fb885b6e5bc47fcfc
SHA512 7ce9b7ddb9d23bdb27ae92a4576ab2a81f7af1d374e0a3aede9457c39b18ecba5f88af0211c43b0de1b08a17ece1d1eba1b7f12d7f985453da1f37429f5e70d0
SSDEEP 393216:cqUuFYYyJ4ZjqITtpRi8TJJEECsfWufTKE06SUuQknLYVe2BSveW:cSFj3R5TJwsXKdHB1LPqW
TLSH
T1682733E503E463ADC196D736696C97052D3F322B4C5B2617E4B8AE0649DA0FCEEF9034
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader loader ransomware

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/816-0-0x00000000036B0000-0x0000000004BEB000-memory.dmp	family_donutloader

Clears Windows event logs 1 TTPs 10 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2764	wevtutil.exe
4240	wevtutil.exe
3360	wevtutil.exe
1988	wevtutil.exe
4812	wevtutil.exe
3484	wevtutil.exe
3024	wevtutil.exe
3324	wevtutil.exe
296	wevtutil.exe
2804	wevtutil.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apphost.exe

Executes dropped EXE 1 IoCs

pid	Process
3056	apphost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	apphost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	apphost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	apphost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	apphost.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
816	apphost.exe
816	apphost.exe
816	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe
3056	apphost.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	apphost.exe
Token: SeDebugPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeSecurityPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeSecurityPrivilege	3056	apphost.exe
Token: SeSecurityPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeSecurityPrivilege	296	wevtutil.exe
Token: SeBackupPrivilege	296	wevtutil.exe
Token: SeSecurityPrivilege	3484	wevtutil.exe
Token: SeBackupPrivilege	3484	wevtutil.exe
Token: SeSecurityPrivilege	2804	wevtutil.exe
Token: SeBackupPrivilege	2804	wevtutil.exe
Token: SeSecurityPrivilege	2764	wevtutil.exe
Token: SeBackupPrivilege	2764	wevtutil.exe
Token: SeSecurityPrivilege	4240	wevtutil.exe
Token: SeBackupPrivilege	4240	wevtutil.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeSecurityPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeSecurityPrivilege	3056	apphost.exe
Token: SeSecurityPrivilege	3056	apphost.exe
Token: SeBackupPrivilege	3056	apphost.exe
Token: SeSecurityPrivilege	3360	wevtutil.exe
Token: SeBackupPrivilege	3360	wevtutil.exe
Token: SeSecurityPrivilege	1988	wevtutil.exe
Token: SeBackupPrivilege	1988	wevtutil.exe
Token: SeSecurityPrivilege	3024	wevtutil.exe
Token: SeBackupPrivilege	3024	wevtutil.exe
Token: SeSecurityPrivilege	3324	wevtutil.exe
Token: SeBackupPrivilege	3324	wevtutil.exe
Token: SeSecurityPrivilege	4812	wevtutil.exe
Token: SeBackupPrivilege	4812	wevtutil.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3056	816	apphost.exe	89
PID 3056 wrote to memory of 296	3056	apphost.exe	90
PID 3056 wrote to memory of 3484	3056	apphost.exe	92
PID 3056 wrote to memory of 2804	3056	apphost.exe	94
PID 3056 wrote to memory of 2764	3056	apphost.exe	96
PID 3056 wrote to memory of 4240	3056	apphost.exe	98
PID 3056 wrote to memory of 3360	3056	apphost.exe	101
PID 3056 wrote to memory of 1988	3056	apphost.exe	103
PID 3056 wrote to memory of 3024	3056	apphost.exe	105
PID 3056 wrote to memory of 3324	3056	apphost.exe	107
PID 3056 wrote to memory of 4812	3056	apphost.exe	109

C:\Users\Admin\AppData\Local\Temp\apphost.exe
"C:\Users\Admin\AppData\Local\Temp\apphost.exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816
- C:\apphost.exe
  "C:\apphost.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:296
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "Windows PowerShell"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil" cl "System"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apphost.exe

Path C:\apphost.exe
Size 20.2MB
SHA256 ecea0d2c076632ef15c6c928bcd324a31e9d404a816b1b887ddcecf6a174905c
MD5 3013f1ab249470ff5f709ecbf3b14326
SHA1 965423fc0f556be813f56bae0a37e2c48caa1bba
SHA512 4aabc9b60eeda03bf908badbd6f9a1ef3669e1b385edcedb9a40158f3e1cb0a38b820ddc3a1ece20dfb7893b95269bd8bc633ccd256fc6ba6883549417ee686f
SSDEEP 393216:D0LGBz8I9xrIj1sKDX8QbJq4BWr3b8tvjuCopk19MouqWBR7Iz0H:4qBtBQbc4orot7uCoijvu7D7Izs
TLSH
T176273306E6A9254DDBCD6D347CB06332622E6280BBFDDD85E3AD1171C6A72EDF643090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-12-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-9-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-3-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-4-0x0000000020190000-0x00000000216CE000-memory.dmp

Download

memory/816-5-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-7-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-6-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-13-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-0-0x00000000036B0000-0x0000000004BEB000-memory.dmp

Download

memory/816-10-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-2-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-11-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-8-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-14-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/816-1-0x00007FF8E63AF000-0x00007FF8E63B0000-memory.dmp

Download

memory/816-33-0x0000000000400000-0x000000000193F000-memory.dmp

Download

memory/816-34-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/3056-30-0x000000001F840000-0x000000001FA5C000-memory.dmp

Download

memory/3056-32-0x0000000003610000-0x0000000003622000-memory.dmp

Download

memory/3056-27-0x000000001EA80000-0x000000001F028000-memory.dmp

Download

memory/3056-26-0x000000001FEA0000-0x00000000212C6000-memory.dmp

Download

memory/3056-45-0x000000002AC10000-0x000000002AC32000-memory.dmp

Download

memory/3056-46-0x000000002AC40000-0x000000002AC7C000-memory.dmp

Download