donutloader | ae79a18faa326d8522701a36850a9d511cdf0450f59ee5cf678b5ddf1bd441cb

General

Target
task_360.exe
Size 1.7MB
Sample261031-3rw5lass8j
SHA256 ae79a18faa326d8522701a36850a9d511cdf0450f59ee5cf678b5ddf1bd441cb
MD5 be6a6fee9eea10e88a40335604d945fe
SHA1 263b60b3005e2a63b8c74c55439311aa10a8da66
SHA512 ea3e4423087841f1862cb07c62b1e88a2f04c807d99ec8098ba1b7a9a0b843d330141ea695f13e38db0a363c9a64bafd85f122f245d7b94c03a9621cfc38c867
SSDEEP 24576:kazuG3g8nPRJOxv3eYtxVKtnTh2qEnyf0K/w6GFe2V3TiODZ:kaz5gGpJQvtxchh2qEnyBnO3T
TLSH
T19A853B2AE2A350FCC56BD170835B9272F971B42951347D7F1F94CB301F22E605A6EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader loader persistence privilege_escalation

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4280-9-0x0000016567BA0000-0x0000016567F36000-memory.dmp	family_donutloader

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2860	netsh.exe
4476	netsh.exe
236	netsh.exe
4232	netsh.exe
5456	netsh.exe
3284	netsh.exe
6004	netsh.exe
5808	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\Geo\Nation	task_360.exe

Executes dropped EXE 1 IoCs

pid	Process
5112	assistant.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	9	205.185.115.131	5112	assistant.exe
Destination IP	10	205.185.115.131	4280	task_360.exe
Destination IP	330	205.185.115.131	5112	assistant.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	task_360.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	task_360.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	assistant.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	assistant.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 5808	4280	task_360.exe	88
PID 4280 wrote to memory of 2860	4280	task_360.exe	91
PID 4280 wrote to memory of 4476	4280	task_360.exe	93
PID 4280 wrote to memory of 236	4280	task_360.exe	95
PID 4280 wrote to memory of 5112	4280	task_360.exe	98
PID 5112 wrote to memory of 4232	5112	assistant.exe	99
PID 5112 wrote to memory of 5456	5112	assistant.exe	101
PID 5112 wrote to memory of 3284	5112	assistant.exe	103
PID 5112 wrote to memory of 6004	5112	assistant.exe	105

C:\Users\Admin\AppData\Local\Temp\task_360.exe
"C:\Users\Admin\AppData\Local\Temp\task_360.exe"
1⤵
- Checks computer location settings
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_in_tcp" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\task_360.exe" enable=yes protocol=tcp
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5808
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_out_tcp" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\task_360.exe" enable=yes protocol=tcp
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2860
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_in_udp" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\task_360.exe" enable=yes protocol=udp
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4476
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_out_udp" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\task_360.exe" enable=yes protocol=udp
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:236
- C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe
  "C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe"
  2⤵
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_in_tcp" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe" enable=yes protocol=tcp
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4232
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_out_tcp" dir=out action=allow program="C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe" enable=yes protocol=tcp
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5456
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_in_udp" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe" enable=yes protocol=udp
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3284
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="AvisLoad_out_udp" dir=out action=allow program="C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe" enable=yes protocol=udp
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

assistant.exe

Path C:\Users\Admin\AppData\Roaming\VLCAssistant\assistant.exe
Size 1.7MB
SHA256 ae79a18faa326d8522701a36850a9d511cdf0450f59ee5cf678b5ddf1bd441cb
MD5 be6a6fee9eea10e88a40335604d945fe
SHA1 263b60b3005e2a63b8c74c55439311aa10a8da66
SHA512 ea3e4423087841f1862cb07c62b1e88a2f04c807d99ec8098ba1b7a9a0b843d330141ea695f13e38db0a363c9a64bafd85f122f245d7b94c03a9621cfc38c867
SSDEEP 24576:kazuG3g8nPRJOxv3eYtxVKtnTh2qEnyf0K/w6GFe2V3TiODZ:kaz5gGpJQvtxchh2qEnyBnO3T
TLSH
T19A853B2AE2A350FCC56BD170835B9272F971B42951347D7F1F94CB301F22E605A6EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4280-0-0x00007FF611160000-0x00007FF611326000-memory.dmp

Download

memory/4280-5-0x00007FF611160000-0x00007FF611326000-memory.dmp

Download

memory/4280-8-0x00007FF611160000-0x00007FF611326000-memory.dmp

Download

memory/4280-9-0x0000016567BA0000-0x0000016567F36000-memory.dmp

Download

memory/4280-11-0x0000016568400000-0x0000016568797000-memory.dmp

Download

memory/4280-14-0x00007FF611160000-0x00007FF611326000-memory.dmp

Download

memory/5112-15-0x00007FF6E1280000-0x00007FF6E1446000-memory.dmp

Download

memory/5112-20-0x00007FF6E1280000-0x00007FF6E1446000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads