donutloader | ae79a18faa326d8522701a36850a9d511cdf0450f59ee5cf678b5ddf1bd441cb

General

Target
task_360.exe
Size 1.7MB
Sample261031-3rw5lass8j
SHA256 ae79a18faa326d8522701a36850a9d511cdf0450f59ee5cf678b5ddf1bd441cb
MD5 be6a6fee9eea10e88a40335604d945fe
SHA1 263b60b3005e2a63b8c74c55439311aa10a8da66
SHA512 ea3e4423087841f1862cb07c62b1e88a2f04c807d99ec8098ba1b7a9a0b843d330141ea695f13e38db0a363c9a64bafd85f122f245d7b94c03a9621cfc38c867
SSDEEP 24576:kazuG3g8nPRJOxv3eYtxVKtnTh2qEnyf0K/w6GFe2V3TiODZ:kaz5gGpJQvtxchh2qEnyBnO3T
TLSH
T19A853B2AE2A350FCC56BD170835B9272F971B42951347D7F1F94CB301F22E605A6EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader loader persistence privilege_escalation

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4960-5-0x0000024F647B0000-0x0000024F64B46000-memory.dmp	family_donutloader

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3212	netsh.exe
4608	netsh.exe
2076	netsh.exe
4828	netsh.exe
880	netsh.exe
1096	netsh.exe
2980	netsh.exe
2776	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	task_360.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	assistant.exe

Executes dropped EXE 1 IoCs

pid	Process
3888	assistant.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	281	205.185.115.131	3888	assistant.exe
Destination IP	13	205.185.115.131	3888	assistant.exe
Destination IP	14	205.185.115.131	4960	task_360.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	task_360.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	task_360.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	assistant.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	assistant.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2076	4960	task_360.exe	86
PID 4960 wrote to memory of 4828	4960	task_360.exe	88
PID 4960 wrote to memory of 880	4960	task_360.exe	90
PID 4960 wrote to memory of 1096	4960	task_360.exe	92
PID 4960 wrote to memory of 3888	4960	task_360.exe	103
PID 3888 wrote to memory of 2980	3888	assistant.exe	104
PID 3888 wrote to memory of 2776	3888	assistant.exe	106
PID 3888 wrote to memory of 3212	3888	assistant.exe	108
PID 3888 wrote to memory of 4608	3888	assistant.exe	110

C:\Users\Admin\AppData\Local\Temp\task_360.exe
"C:\Users\Admin\AppData\Local\Temp\task_360.exe"
1⤵
- Checks computer location settings
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_in_tcp" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\task_360.exe" enable=yes protocol=tcp
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2076
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_out_tcp" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\task_360.exe" enable=yes protocol=tcp
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4828
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_in_udp" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\task_360.exe" enable=yes protocol=udp
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:880
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_out_udp" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\task_360.exe" enable=yes protocol=udp
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1096
- C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe
  "C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_in_tcp" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe" enable=yes protocol=tcp
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2980
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_out_tcp" dir=out action=allow program="C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe" enable=yes protocol=tcp
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2776
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_in_udp" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe" enable=yes protocol=udp
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3212
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_out_udp" dir=out action=allow program="C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe" enable=yes protocol=udp
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

assistant.exe

Path C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe
Size 1.7MB
SHA256 ae79a18faa326d8522701a36850a9d511cdf0450f59ee5cf678b5ddf1bd441cb
MD5 be6a6fee9eea10e88a40335604d945fe
SHA1 263b60b3005e2a63b8c74c55439311aa10a8da66
SHA512 ea3e4423087841f1862cb07c62b1e88a2f04c807d99ec8098ba1b7a9a0b843d330141ea695f13e38db0a363c9a64bafd85f122f245d7b94c03a9621cfc38c867
SSDEEP 24576:kazuG3g8nPRJOxv3eYtxVKtnTh2qEnyf0K/w6GFe2V3TiODZ:kaz5gGpJQvtxchh2qEnyBnO3T
TLSH
T19A853B2AE2A350FCC56BD170835B9272F971B42951347D7F1F94CB301F22E605A6EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3888-14-0x00007FF6C92E0000-0x00007FF6C94A6000-memory.dmp

Download

memory/3888-18-0x00007FF6C92E0000-0x00007FF6C94A6000-memory.dmp

Download

memory/4960-0-0x00007FF7C7CF0000-0x00007FF7C7EB6000-memory.dmp

Download

memory/4960-4-0x00007FF7C7CF0000-0x00007FF7C7EB6000-memory.dmp

Download

memory/4960-5-0x0000024F647B0000-0x0000024F64B46000-memory.dmp

Download

memory/4960-7-0x0000024F64F90000-0x0000024F65327000-memory.dmp

Download

memory/4960-13-0x00007FF7C7CF0000-0x00007FF7C7EB6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads