Analysis
- max time kernel
148s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 09:27
Behavioral task
behavioral1
Sample
Tax_Notice_23665.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax_Notice_23665.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
nvdahelperremote.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
nvdahelperremote.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target nvdahelperremote.dll
- Size 444KB
- Sample260910-leqcva1dmf
- SHA256 7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94
- MD5 1f23d7cc6d6354c0e7b24eaa0652d96d
- SHA1 7ecde045e2d31a63312d7cd9c482e0d4aa74c7fc
- SHA512 6b9d778105e37d59f965ddd62f7c168534aad6c3055f5ae432fde12026cd9cb1464dba0abecf8fe6bc3d18fa5c37e0f5f871d39192802266e2cb7fde00a51131
- SSDEEP 6144:mrD9MHURHn18ScLDmy7OG1rQi5zeM4/hzcoAsYd9WAnnnOD9LJo:mNMAH1W3lF4/h4oAFd9W9LJo
- TLSH T137A4AE58EBD177F3E23220B872D8CA8A07C4DED7D1D491B3ADA62C1D4AD591208F2977
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral4/memory/1548-0-0x00000000012F0000-0x0000000001356000-memory.dmp family_donutloader - Executes dropped EXE 1 IoCs
pid Process 4168 rundll32.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\NvSvc = "C:\\ProgramData\\NVIDIA Corporation\\NvSvc\\rundll32.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvSvc = "C:\\ProgramData\\NVIDIA Corporation\\NvSvc\\rundll32.exe" rundll32.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4264 set thread context of 1548 4264 rundll32.exe 89 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5808 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4264 rundll32.exe 4264 rundll32.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 1548 4264 rundll32.exe 89 PID 4264 wrote to memory of 5808 4264 rundll32.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nvdahelperremote.dll,#11⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1548
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN NvSvc /TR "\"C:\ProgramData\NVIDIA Corporation\NvSvc\rundll32.exe\"" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:5808
-
-
C:\ProgramData\NVIDIA Corporation\NvSvc\rundll32.exe"C:\ProgramData\NVIDIA Corporation\NvSvc\rundll32.exe"1⤵
- Executes dropped EXE
PID:4168
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NVIDIA Corporation\NvSvc\rundll32.exe
- Size 88KB
- SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
- MD5 025b13bf5652712d9b596e6766a9c386
- SHA1 def4011b5536983285472ba75c22c6a2410edf6a
- SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
- SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
- TLSH T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
- MD5 SHA1 SHA512 SSDEEP TLSH