Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 09:27
Behavioral task
behavioral1
Sample
Tax_Notice_23665.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax_Notice_23665.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
nvdahelperremote.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
nvdahelperremote.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target nvdahelperremote.dll
- Size 444KB
- Sample260910-leqcva1dmf
- SHA256 7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94
- MD5 1f23d7cc6d6354c0e7b24eaa0652d96d
- SHA1 7ecde045e2d31a63312d7cd9c482e0d4aa74c7fc
- SHA512 6b9d778105e37d59f965ddd62f7c168534aad6c3055f5ae432fde12026cd9cb1464dba0abecf8fe6bc3d18fa5c37e0f5f871d39192802266e2cb7fde00a51131
- SSDEEP 6144:mrD9MHURHn18ScLDmy7OG1rQi5zeM4/hzcoAsYd9WAnnnOD9LJo:mNMAH1W3lF4/h4oAFd9W9LJo
- TLSH T137A4AE58EBD177F3E23220B872D8CA8A07C4DED7D1D491B3ADA62C1D4AD591208F2977
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral3/memory/6044-0-0x0000000000510000-0x0000000000576000-memory.dmp family_donutloader - Executes dropped EXE 1 IoCs
pid Process 2868 rundll32.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\NvSvc = "C:\\ProgramData\\NVIDIA Corporation\\NvSvc\\rundll32.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvSvc = "C:\\ProgramData\\NVIDIA Corporation\\NvSvc\\rundll32.exe" rundll32.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4744 set thread context of 6044 4744 rundll32.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4168 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4744 rundll32.exe 4744 rundll32.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 6044 4744 rundll32.exe 85 PID 4744 wrote to memory of 4168 4744 rundll32.exe 86 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nvdahelperremote.dll,#11⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
PID:6044
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN NvSvc /TR "\"C:\ProgramData\NVIDIA Corporation\NvSvc\rundll32.exe\"" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:4168
-
-
C:\ProgramData\NVIDIA Corporation\NvSvc\rundll32.exe"C:\ProgramData\NVIDIA Corporation\NvSvc\rundll32.exe"1⤵
- Executes dropped EXE
PID:2868
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NVIDIA Corporation\NvSvc\rundll32.exe
- Size 70KB
- SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
- MD5 ef3179d498793bf4234f708d3be28633
- SHA1 dd399ae46303343f9f0da189aee11c67bd868222
- SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
- SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
- TLSH T16B630BC9A66460F4E077953444734E099272BC22D7625ADF54F0F17C0FF36E0A93AAAB
- MD5 SHA1 SHA512 SSDEEP TLSH