Analysis
- max time kernel
76s - max time network
78s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 18:24
General
- Target update.exe
- Size 8.4MB
- Sample261101-w15prses6q
- SHA256 32d6d0ab3c2bcd76bc6e194092f9abfac1e9fe57c2565f965efab55aa3f4f5f5
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\notepad.exenotepad.exe2⤵
-
-
C:\Windows\SYSTEM32\notepad.exenotepad.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1984-4-0x00007FF76CEA0000-0x00007FF76D707000-memory.dmp
memory/1984-7-0x00007FF76CEA0000-0x00007FF76D707000-memory.dmp
memory/5496-5-0x0000018AE43A0000-0x0000018AE4B4C000-memory.dmp
memory/5496-6-0x0000018AE43A0000-0x0000018AE4B4C000-memory.dmp
memory/5496-8-0x0000018AE6330000-0x0000018AE92F8000-memory.dmp
memory/5496-9-0x0000018AE43A0000-0x0000018AE4B4C000-memory.dmp
memory/5712-0-0x000001F308C10000-0x000001F308C77000-memory.dmp
memory/5712-2-0x000001F308DB0000-0x000001F308DEA000-memory.dmp