Analysis
- max time kernel
85s - max time network
87s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
01/11/2026, 18:24
General
- Target update.exe
- Size 8.4MB
- Sample261101-w15prses6q
- SHA256 32d6d0ab3c2bcd76bc6e194092f9abfac1e9fe57c2565f965efab55aa3f4f5f5
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\notepad.exenotepad.exe2⤵
-
-
C:\Windows\SYSTEM32\notepad.exenotepad.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3892-0-0x0000020C19B90000-0x0000020C19BF7000-memory.dmp
memory/3892-2-0x0000020C19D20000-0x0000020C19D5A000-memory.dmp
memory/4116-7-0x000001AC4EC30000-0x000001AC4F3DC000-memory.dmp
memory/4116-5-0x000001AC4EC30000-0x000001AC4F3DC000-memory.dmp
memory/4116-8-0x000001AC50C60000-0x000001AC53C28000-memory.dmp
memory/4964-4-0x00007FF615D80000-0x00007FF6165E7000-memory.dmp
memory/4964-6-0x00007FF615D80000-0x00007FF6165E7000-memory.dmp