Analysis
- max time kernel
148s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/09/2026, 15:22
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
GSTR-3B_Overdue_Notice_S47_06AAAGC2597F2ZI_23092026.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
tedutil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
tedutil.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target tedutil.dll
- Size 102KB
- Sample260923-sr5rmathje
- SHA256 83cfa06e84360705a2fdfa332a8324e37dd9be45f23e37fa4a4a557f46e078f2
- MD5 24d21f9c82d4c8525fe473d125afa223
- SHA1 88ed135a0b687f9b2c90d54f7ca33e5cde3e9e4e
- SHA512 8e0a8644a3ad21195bd40785161f662692b899a3fd229e08e7dc653b4b8fcd2b2164b562e9b445e89c9d0079b03ca6a6e5115604317f5374cb0b1658fdf18f6e
- SSDEEP 3072:Qqmc7LsppHxb1WhINEBkofoLmT5Onk6lsPGBIejgFm8MChYXfMFiroBRl/XmFMff:Qqmc7LcoALC5Onk6lsPGBIejgFm8MChE
- TLSH T139A357456575BCB8C526803E9207632293B23C4DC3316667BAE9DD243F97F606B2E7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/memory/5096-19-0x00000218B7720000-0x00000218B7E43000-memory.dmp family_donutloader - Detects Overlord RAT 1 IoCs
resource yara_rule behavioral2/memory/5096-21-0x00000218BB680000-0x00000218BE9F7000-memory.dmp family_overlord - Executes dropped EXE 1 IoCs
pid Process 4960 ExplorerBroker.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate_m13C = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_m13CyPYz\\ExplorerBroker.exe" regsvr32.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 65 api.ipify.org 66 api.ipify.org -
pid Process 2832 powershell.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RuntimeBroker.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{2CA1C2AE-5290-47A5-9641-E19619DEFF0A} RuntimeBroker.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{E8421B9C-94DB-406D-AF36-72E6E784A350} RuntimeBroker.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 544 regsvr32.exe 544 regsvr32.exe 544 regsvr32.exe 544 regsvr32.exe 2832 powershell.exe 2832 powershell.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2832 powershell.exe Token: SeIncreaseQuotaPrivilege 2832 powershell.exe Token: SeSecurityPrivilege 2832 powershell.exe Token: SeTakeOwnershipPrivilege 2832 powershell.exe Token: SeLoadDriverPrivilege 2832 powershell.exe Token: SeSystemProfilePrivilege 2832 powershell.exe Token: SeSystemtimePrivilege 2832 powershell.exe Token: SeProfSingleProcessPrivilege 2832 powershell.exe Token: SeIncBasePriorityPrivilege 2832 powershell.exe Token: SeCreatePagefilePrivilege 2832 powershell.exe Token: SeBackupPrivilege 2832 powershell.exe Token: SeRestorePrivilege 2832 powershell.exe Token: SeShutdownPrivilege 2832 powershell.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeSystemEnvironmentPrivilege 2832 powershell.exe Token: SeRemoteShutdownPrivilege 2832 powershell.exe Token: SeUndockPrivilege 2832 powershell.exe Token: SeManageVolumePrivilege 2832 powershell.exe Token: 33 2832 powershell.exe Token: 34 2832 powershell.exe Token: 35 2832 powershell.exe Token: 36 2832 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97 PID 544 wrote to memory of 5096 544 regsvr32.exe 97
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tedutil.dll1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\system32\RuntimeBroker.exe"C:\Windows\system32\RuntimeBroker.exe"2⤵
- Checks processor information in registry
- Modifies registry class
PID:5096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -like '*C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_m13CyPYz*' } | Select-Object -ExpandProperty ProcessId"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_m13CyPYz\ExplorerBroker.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_m13CyPYz\ExplorerBroker.exe1⤵
- Executes dropped EXE
PID:4960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_m13CyPYz\ExplorerBroker.exe
- Size 24KB
- SHA256 022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
- MD5 b0c2fa35d14a9fad919e99d9d75e1b9e
- SHA1 8d7c2fd354363daee63e8f591ec52fa5d0e23f6f
- SHA512 a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
- SSDEEP 384:n5Y3wBQ8l/m60z+G7XU9I6ExBOMDl16AvcX9dp/Ql7YQCrA2WrcLHW:n5Yg3l/mTRXU9FeGpX9dp/47tCnL
- TLSH T1C4B21A0897EA2499E5BA973998F31225D771353117014FFF39E4823A0F22BD19E36F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_m13CyPYz\settings.dat
- Size 7.1MB
- SHA256 07b7dcccb71931c16b2b17da61fff70bc0ea67808306b4f303272c28bde1142f
- MD5 7d534e3795dc9e113d220153ebc6fc2f
- SHA1 4d081237fd61bd5a47da6681b37d948ca8bc9b06
- SHA512 fc246178bdf57b66028e5f3b9c61bc4e9bf1151c1718719bcb57a47bf85022b9234c11c6d13675da9ba4a2b8021c55b4484d6e84a7107895b55b8f0a8ce61e22
- SSDEEP 98304:4bKwkQlOx/Rm4QskC4nmEK2RJGhxkxPNBcQwpvn5yfgXOywtAieAkbG+84Ge/h+v:4PkVQsBERMh8lsJ5yfgeywYnbY7r
- TLSH T1557633A591CFA5D01C8032B33F9F911CC79ED9614E1826A3FAB4E58991F857F1E683C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_m13CyPYz\tedutil.dll
- Size 102KB
- SHA256 83cfa06e84360705a2fdfa332a8324e37dd9be45f23e37fa4a4a557f46e078f2
- MD5 24d21f9c82d4c8525fe473d125afa223
- SHA1 88ed135a0b687f9b2c90d54f7ca33e5cde3e9e4e
- SHA512 8e0a8644a3ad21195bd40785161f662692b899a3fd229e08e7dc653b4b8fcd2b2164b562e9b445e89c9d0079b03ca6a6e5115604317f5374cb0b1658fdf18f6e
- SSDEEP 3072:Qqmc7LsppHxb1WhINEBkofoLmT5Onk6lsPGBIejgFm8MChYXfMFiroBRl/XmFMff:Qqmc7LcoALC5Onk6lsPGBIejgFm8MChE
- TLSH T139A357456575BCB8C526803E9207632293B23C4DC3316667BAE9DD243F97F606B2E7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rs3brx1x.he1.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH