Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 07:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kvpins64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
kvpins64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
kvpvbsext64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
kvpvbsext64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
kvpvbsext64_orig.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
kvpvbsext64_orig.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target kvpins64.exe
- Size 353KB
- Sample261102-jrncxaee39
- SHA256 5b4c1dc1d629341286cefa03133aaf2a041ee24aa022f7cd845924f210f1ce6d
- MD5 16118227770402f79938d1f9ded3ce49
- SHA1 1db92873f396a4a944e223c90778098129a01f80
- SHA512 533e17c4d0b6bf2332d533c4beda98882efe3cf986a36e1dcfe6664c3be5d22605bd2f6f3b378ccf22f8a211b052c884e802660a4bca7dd7af13c6f1a855b6ec
- SSDEEP 6144:FXdnf1VDU2mMQTyydY3xlTD+qAM4mF5sAOj/dxCwfiUzgQ:Ftnf1W298gPeW4OSdxmOgQ
- TLSH T1F0749D56B3A81CE9E837C1388D529A16EBB27C610710C7DF1364876A9F736E0AD3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral1/memory/4284-25-0x000002121C9B0000-0x000002121D34E000-memory.dmp family_donutloader - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4284 cmd.exe 7 1088 cmd.exe - Executes dropped EXE 1 IoCs
pid Process 2640 kvpins64.exe - Loads dropped DLL 2 IoCs
pid Process 2640 kvpins64.exe 2640 kvpins64.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe 4284 cmd.exe 1088 cmd.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeLockMemoryPrivilege 4284 cmd.exe Token: SeLockMemoryPrivilege 4284 cmd.exe Token: SeLockMemoryPrivilege 1088 cmd.exe Token: SeLockMemoryPrivilege 1088 cmd.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4284 cmd.exe 1088 cmd.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 4284 1684 kvpins64.exe 85 PID 1684 wrote to memory of 4284 1684 kvpins64.exe 85 PID 2640 wrote to memory of 1088 2640 kvpins64.exe 89 PID 2640 wrote to memory of 1088 2640 kvpins64.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\kvpins64.exe"C:\Users\Admin\AppData\Local\Temp\kvpins64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" --dec "C:\Users\Public\HostSvc\config_enc.json"2⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4284
-
-
C:\Users\Public\HostSvc\kvpins64.exeC:\Users\Public\HostSvc\kvpins64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" --dec "C:\Users\Public\HostSvc\config_enc.json"2⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1088
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\HostSvc\_stage.log
- Size 925B
- SHA256 f0f2f55927580a067b33c1b0f947eb9cccbcaf14b6c945a2835a0fe8a7a7f16f
- MD5 e4b654d3efd7187a7c6d6514a8e847bd
- SHA1 451c985e9471c9767dc7134652db0cf955d62e50
- SHA512 53917398969d26f60e94b48336b28ca1c6cd3a8c09e9ad283c70bd85dbac018ade97ba82a05ae6905da11dac3724686a590f1fac911b3f0f61ba0a3ebf16e0ef
- TLSH T1D3115E04FDE5C6A6E6A0E2531E1056F574F7B5046DAA422AD75E41C902AB8CFA393230
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\_stage.log
- Size 1KB
- SHA256 bd4e92709f1802acd25ad9f07dadbd0d2c46199b3fcfc33617ec584665546392
- MD5 f03a8bce0e662d08836588d216583188
- SHA1 658001c19fd6524d926de122a12a999fece1d981
- SHA512 56db9f1779ab5b95bc0febb125a88680bbbf41c7a89548f300d6df72dcdbe04389f57c018e3a62b46a66df13af1b1dbaed0040a885ade4ea54da49bac43d9802
- TLSH T1B9318D04FDB9C5A7E6A1A2532B1006F6B5F3F5012C9E822DDA5E41CD12AB8CFA393134
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\_stage.log
- Size 2KB
- SHA256 e041f3f0a733cdba48d222cb6dfc95a269d709acca518695031d6d05dae643ef
- MD5 7ce63f5de3672b9a11e315e9f47d241a
- SHA1 b4717a108b6fa8c03d2a715d1a3c3bc88e1b8ed3
- SHA512 ea43dd5c9c86fa24f5ea82177b395e97c4d78b60ec495ca8d3a878da3d4960bb8dc89dcdb6808d0602731d6fdd3725a489d2fd65e13069d3522e4e1867f6991d
- TLSH T1B141C304FDE4C6A6E790A2432A1046F675F3F1016CAE812EEA5E41CD136B8CFA356234
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\config_enc.json
- Size 2KB
- SHA256 67c39225831a8e2dc490511285b5d92ec56cee246d270fde63ce924d44dd94a0
- MD5 f8361e5bc468c5256ff9fba2ccf9f2da
- SHA1 25705083b433162af6e3810669e8209b7006fb5f
- SHA512 6ef5be2d726fc6971a895a518c349dc64afd95874f8f3b48d211f85bf76f2d81af8b47d74c05e132072978928aab7890088f51fa3bba6b0aae26482aa129bb5f
- TLSH T159512A00060BE681B4D0703DD1580625CFF5D6DD78F29EF06E9E88AFFD655133A6889D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\kvpins64.exe
- Size 353KB
- SHA256 5b4c1dc1d629341286cefa03133aaf2a041ee24aa022f7cd845924f210f1ce6d
- MD5 16118227770402f79938d1f9ded3ce49
- SHA1 1db92873f396a4a944e223c90778098129a01f80
- SHA512 533e17c4d0b6bf2332d533c4beda98882efe3cf986a36e1dcfe6664c3be5d22605bd2f6f3b378ccf22f8a211b052c884e802660a4bca7dd7af13c6f1a855b6ec
- SSDEEP 6144:FXdnf1VDU2mMQTyydY3xlTD+qAM4mF5sAOj/dxCwfiUzgQ:Ftnf1W298gPeW4OSdxmOgQ
- TLSH T1F0749D56B3A81CE9E837C1388D529A16EBB27C610710C7DF1364876A9F736E0AD3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\HostSvc\kvpvbsext64.dll
- Size 12.8MB
- SHA256 e28a6f4d8a08c79cb8d198263e819dc339634da08faf8b97d162d95d34cb3f42
- MD5 8506ace59fd90a0845ff76018ac076b2
- SHA1 fa693dcb2d8cc682e8da6417e5f47ec82ea9007f
- SHA512 385cd41fe779a99e8f7ca23e59c6c20a11e9f35f420252a812f4792687012ec33e9820e9f229158fceeee8edd71017686e9447c85197f82e9a9a8a597fec25aa
- SSDEEP 393216:O8+QhOxrvXOKjZuArEdXnMAc03NmwswqBMVGsIX0q:O/DxrvXOauMEd/c0MwqBsGsI
- TLSH T1A1D633D28517B4C7C8BBE07F8EC3AEF1239E67D44578822FEE0586C530851D29DA8766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\HostSvc\kvpvbsext64_orig.dll
- Size 172KB
- SHA256 77e95ee19a449079ea45db6d93ac8395835affff906334f0344210f695d77bdc
- MD5 6fc5a288190eed2942ee329b9920bc40
- SHA1 8b532ffb8325cedba63d6e0cee70e148b3a09653
- SHA512 c9f7aaa31764003660985a09dd70ed0cdd31682ffd258d54632a835bd91ef61d778a00579bcbe558ab432522a73138374ed74c2ca4416d894b3e8aa3b6f52323
- SSDEEP 3072:L+QSohtIDshvGzH5lOVVshHRHClFROl613LBCWxWde:L+QTWDjbOrsXHCNnbAs
- TLSH T11E047C57B2A454BBE437C634C9935A12EB7674510B6097DF0364827E2F633E0AE3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\HostSvc\payload.enc
- Size 12.8MB
- SHA256 82b612790b4355a3a9d8d146d590acf7aa3d0ebf1dee2b0aa96979260fee4230
- MD5 67244ba26d41ab4160b7d127f522a7f3
- SHA1 fa295421b468e9efa85eaf791a82582397d6adda
- SHA512 0799d2f6d472630fd903e1ef82e8dad0dc01b106ba541992b274c89919c24c55f08c7aeb0dc2736f3e602e8724719a7cd150ebbeec88ad1616646c957fb8e6ec
- SSDEEP 49152:Ht8bohaFH12P0SlhcvD+x8Kzosei4jxDbhvmb8z27fh/+MVAGi55R+zckesDnlNv:h
- TLSH T1A7D633215EA66EBE056CD33D30BF1F5D2AE14F51800CE6EB63D5A48723ADB90511B83E
- MD5 SHA1 SHA512 SSDEEP TLSH