donutloader | 2a78fb704b96cfc88272ca8855b6599e663ceffadc801d488eb128b18c234954

General

Target
accevent.exe
Size 10.7MB
Sample261029-145ldsfs8x
SHA256 2a78fb704b96cfc88272ca8855b6599e663ceffadc801d488eb128b18c234954
MD5 95084247560c5fe1bb537c34e47a2fb7
SHA1 36013f4b8444cd913f8353d06cfb1f208af61ea5
SHA512 58b5f6edbd82757c1e8ac7250c6efc6ad3e610a6f4709791afaa4777d7bc1baaeec92e967dbbfd0774239f126e4e83d3620c5f319b8d34022f06463a67176501
SSDEEP 98304:FCE4Rhep0+YM+aADQX4xcELw34Ldlhf9PJNgb5j6HBT+TXqRDPb/FpNSykeEpW2:X4Rq0+YM+HMflcDhlPbijY8X+/zkf
TLSH
T16FB69CB5F1A5AC6EDC0A31BD7769A47F0BA5A2D6034902EB13F5C15AC9282C44CF7E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader loader persistence privilege_escalation

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4816-6-0x0000022346E10000-0x0000022347501000-memory.dmp	family_donutloader

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3356	netsh.exe
5476	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
6072	accevent.exe

Loads dropped DLL 3 IoCs

pid	Process
4804	accevent.exe
6072	accevent.exe
6072	accevent.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate_x9PR = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_x9PRTh31\\accevent.exe"	accevent.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	api.ipify.org
14	api.ipify.org

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	accevent.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5476	netsh.exe
3356	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Accessibility\Blind Access\On = "1"	accevent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Accessibility\Blind Access\On = "1"	accevent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	accevent.exe
4804	accevent.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4804	accevent.exe
6072	accevent.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4816	4804	accevent.exe	93
PID 4804 wrote to memory of 4816	4804	accevent.exe	93
PID 4816 wrote to memory of 5476	4816	RuntimeBroker.exe	96
PID 4816 wrote to memory of 3356	4816	RuntimeBroker.exe	98
PID 6072 wrote to memory of 1460	6072	accevent.exe	106
PID 6072 wrote to memory of 1460	6072	accevent.exe	106

C:\Users\Admin\AppData\Local\Temp\accevent.exe
"C:\Users\Admin\AppData\Local\Temp\accevent.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Direct Volume Access: Opens a physical disk for reading
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\system32\RuntimeBroker.exe
  "C:\Windows\system32\RuntimeBroker.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name=RuntimeBroker.exe program=C:\Windows\System32\RuntimeBroker.exe
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:5476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name=RuntimeBroker.exe dir=in action=allow program=C:\Windows\System32\RuntimeBroker.exe enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:3356

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_x9PRTh31\accevent.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_x9PRTh31\accevent.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\system32\RuntimeBroker.exe
  "C:\Windows\system32\RuntimeBroker.exe"
  2⤵
  PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Direct Volume Access

1

T1006

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

accevent.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_x9PRTh31\accevent.exe
Size 10.7MB
SHA256 2a78fb704b96cfc88272ca8855b6599e663ceffadc801d488eb128b18c234954
MD5 95084247560c5fe1bb537c34e47a2fb7
SHA1 36013f4b8444cd913f8353d06cfb1f208af61ea5
SHA512 58b5f6edbd82757c1e8ac7250c6efc6ad3e610a6f4709791afaa4777d7bc1baaeec92e967dbbfd0774239f126e4e83d3620c5f319b8d34022f06463a67176501
SSDEEP 98304:FCE4Rhep0+YM+aADQX4xcELw34Ldlhf9PJNgb5j6HBT+TXqRDPb/FpNSykeEpW2:X4Rq0+YM+HMflcDhlPbijY8X+/zkf
TLSH
T16FB69CB5F1A5AC6EDC0A31BD7769A47F0BA5A2D6034902EB13F5C15AC9282C44CF7E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

event.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_x9PRTh31\event.dll
Size 144KB
SHA256 366e87f2b2d6a324048bd1f8b4e1736d997560eaeb0081d403ed625131ab34c0
MD5 4483c0055dd98f6aae09328dca7434dc
SHA1 485d9c82753a5f655ec62228b279a8b88f57796b
SHA512 ff19a76b445b06b29d637adc698d89e249d20510d99dbfb15d0bdac5f32e0ea00c939a2777f578e8cc5eb2afee5857355bc2a8593c916168fa9e6308afd31153
SSDEEP 3072:vmYs+2imSDbLwuGiTuZRo6cBJC4o1OEztCZZLMcArWpcetFXFRy:vtsvUFGBZRoLBJCzQEzkY/Hen7y
TLSH
T18BE3BF56F16158A9DC45A0FCA399A97B9FB2B193072510EF03F0C619DD602C06DBFE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5879cf000012c4.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e5879cf000012c4.tmp
Size 66KB
SHA256 6ea80d24bee89f574e2d436d88517603c0d9e07b94943160ae3cb642ac8e753f
MD5 5b3153996a4d56d54750edefe86c81da
SHA1 9e550197ff63d88ae503adf98f04d60a850ad747
SHA512 c2410f4f54b7504522d42ded3a5578682ea728d413c25c6f4124791e4df5f9dfee96db23c14c66c5a632f37ddae42c2da0c3bc80cebf2f57f21361864bbe0cea
SSDEEP 768:wpmtvNNH/jTknvtu00dENPWvLNO9SU3YVG+UeFvi5CCRoJcjbLb6kC9zAMl:/390vtUWWySU3YVG+UeFviYJYnnezAq
TLSH
T168634A50B7F89089F46269B48F67DF4AE830F4985B21C6DF2291834E1E727C48E3577A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1460-21-0x0000014708600000-0x000001470B8F9000-memory.dmp

Download

memory/4804-5-0x000001890B580000-0x000001890B581000-memory.dmp

Download

memory/4816-6-0x0000022346E10000-0x0000022347501000-memory.dmp

Download

memory/4816-7-0x000002234AC00000-0x000002234DEF9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads