Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 07:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kvpins64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
kvpins64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
kvpvbsext64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
kvpvbsext64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
kvpvbsext64_orig.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
kvpvbsext64_orig.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target kvpins64.exe
- Size 353KB
- Sample261102-jrncxaee39
- SHA256 5b4c1dc1d629341286cefa03133aaf2a041ee24aa022f7cd845924f210f1ce6d
- MD5 16118227770402f79938d1f9ded3ce49
- SHA1 1db92873f396a4a944e223c90778098129a01f80
- SHA512 533e17c4d0b6bf2332d533c4beda98882efe3cf986a36e1dcfe6664c3be5d22605bd2f6f3b378ccf22f8a211b052c884e802660a4bca7dd7af13c6f1a855b6ec
- SSDEEP 6144:FXdnf1VDU2mMQTyydY3xlTD+qAM4mF5sAOj/dxCwfiUzgQ:Ftnf1W298gPeW4OSdxmOgQ
- TLSH T1F0749D56B3A81CE9E837C1388D529A16EBB27C610710C7DF1364876A9F736E0AD3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/memory/4864-23-0x000002A5626B0000-0x000002A56304E000-memory.dmp family_donutloader - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4864 cmd.exe 3 1252 cmd.exe - Executes dropped EXE 1 IoCs
pid Process 5800 kvpins64.exe - Loads dropped DLL 2 IoCs
pid Process 5800 kvpins64.exe 5800 kvpins64.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe 1252 cmd.exe 4864 cmd.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeLockMemoryPrivilege 4864 cmd.exe Token: SeLockMemoryPrivilege 4864 cmd.exe Token: SeLockMemoryPrivilege 1252 cmd.exe Token: SeLockMemoryPrivilege 1252 cmd.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4864 cmd.exe 1252 cmd.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4356 wrote to memory of 4864 4356 kvpins64.exe 91 PID 4356 wrote to memory of 4864 4356 kvpins64.exe 91 PID 5800 wrote to memory of 1252 5800 kvpins64.exe 93 PID 5800 wrote to memory of 1252 5800 kvpins64.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\kvpins64.exe"C:\Users\Admin\AppData\Local\Temp\kvpins64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" --dec "C:\Users\Public\HostSvc\config_enc.json"2⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4864
-
-
C:\Users\Public\HostSvc\kvpins64.exeC:\Users\Public\HostSvc\kvpins64.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" --dec "C:\Users\Public\HostSvc\config_enc.json"2⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1252
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\HostSvc\_stage.log
- Size 951B
- SHA256 82dffc45fdd30caf35d3cbfe36ef98f32743443d3e7c5d5207b97c652855e857
- MD5 e9f2cf8407395c1e157392625f792886
- SHA1 f1ea403cf17833504b80f53c15c4a647402af735
- SHA512 79e62c776deb43ec9c201e129cde86f3c9afd3214baa18b2cbaf046c7b65351317e4dcf2a04d29b3ee679f07571ef5e2320056d493c6e1ffc3b6ef75a692f3fb
- TLSH T12911AB04F9A5C2A2E2A1A2635E100AF970F7B4053DAE821EDA4E81CC11978CFB387130
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\_stage.log
- Size 1KB
- SHA256 df304afa4e983d2b0f9a893148c25f93d4827333cd6709e1501188e44bcc9551
- MD5 438cc91990c5cc5c3847dab44e480b1a
- SHA1 df3ab02cb632aa882c90e1a739731222c51802cc
- SHA512 a5b714fed1b8e68b6fc95e0b756c4eb6c1b875d061779ba4dfb70ab4aea484a9476822d12bd1f0c33e139e8b34adf76072a53a637c6f0724386237692c8b5546
- TLSH T151316C48FDB9C6A7E6A1A2536B1006F671F7F0053D9E812DD65E41CD12AB8CFA397038
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\_stage.log
- Size 2KB
- SHA256 7c7f41d866a2134ecc18669d54692735a1a84ff04ba8db6dcdc675a5961f9045
- MD5 ac44083282313c10381dab7bfb673f56
- SHA1 3612850bd919669fc8b76dae000607346dd1e506
- SHA512 e7c4c322878703f59e03beeaabf2424aef746e488f37a433e016ac40ab757c1c62e0936ec242f14e48fb3490d4fe8d549b70ec603ce398cc56cd360c93dd9237
- TLSH T10E41B344FDB5C6A7E691A2535A100AF675F7F1013DAE811EEA4E81CC11678DFB396034
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\config_enc.json
- Size 2KB
- SHA256 67c39225831a8e2dc490511285b5d92ec56cee246d270fde63ce924d44dd94a0
- MD5 f8361e5bc468c5256ff9fba2ccf9f2da
- SHA1 25705083b433162af6e3810669e8209b7006fb5f
- SHA512 6ef5be2d726fc6971a895a518c349dc64afd95874f8f3b48d211f85bf76f2d81af8b47d74c05e132072978928aab7890088f51fa3bba6b0aae26482aa129bb5f
- TLSH T159512A00060BE681B4D0703DD1580625CFF5D6DD78F29EF06E9E88AFFD655133A6889D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\kvpins64.exe
- Size 353KB
- SHA256 5b4c1dc1d629341286cefa03133aaf2a041ee24aa022f7cd845924f210f1ce6d
- MD5 16118227770402f79938d1f9ded3ce49
- SHA1 1db92873f396a4a944e223c90778098129a01f80
- SHA512 533e17c4d0b6bf2332d533c4beda98882efe3cf986a36e1dcfe6664c3be5d22605bd2f6f3b378ccf22f8a211b052c884e802660a4bca7dd7af13c6f1a855b6ec
- SSDEEP 6144:FXdnf1VDU2mMQTyydY3xlTD+qAM4mF5sAOj/dxCwfiUzgQ:Ftnf1W298gPeW4OSdxmOgQ
- TLSH T1F0749D56B3A81CE9E837C1388D529A16EBB27C610710C7DF1364876A9F736E0AD3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\HostSvc\kvpvbsext64.dll
- Size 12.8MB
- SHA256 e28a6f4d8a08c79cb8d198263e819dc339634da08faf8b97d162d95d34cb3f42
- MD5 8506ace59fd90a0845ff76018ac076b2
- SHA1 fa693dcb2d8cc682e8da6417e5f47ec82ea9007f
- SHA512 385cd41fe779a99e8f7ca23e59c6c20a11e9f35f420252a812f4792687012ec33e9820e9f229158fceeee8edd71017686e9447c85197f82e9a9a8a597fec25aa
- SSDEEP 393216:O8+QhOxrvXOKjZuArEdXnMAc03NmwswqBMVGsIX0q:O/DxrvXOauMEd/c0MwqBsGsI
- TLSH T1A1D633D28517B4C7C8BBE07F8EC3AEF1239E67D44578822FEE0586C530851D29DA8766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\HostSvc\kvpvbsext64_orig.dll
- Size 172KB
- SHA256 77e95ee19a449079ea45db6d93ac8395835affff906334f0344210f695d77bdc
- MD5 6fc5a288190eed2942ee329b9920bc40
- SHA1 8b532ffb8325cedba63d6e0cee70e148b3a09653
- SHA512 c9f7aaa31764003660985a09dd70ed0cdd31682ffd258d54632a835bd91ef61d778a00579bcbe558ab432522a73138374ed74c2ca4416d894b3e8aa3b6f52323
- SSDEEP 3072:L+QSohtIDshvGzH5lOVVshHRHClFROl613LBCWxWde:L+QTWDjbOrsXHCNnbAs
- TLSH T11E047C57B2A454BBE437C634C9935A12EB7674510B6097DF0364827E2F633E0AE3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\HostSvc\payload.enc
- Size 12.8MB
- SHA256 82b612790b4355a3a9d8d146d590acf7aa3d0ebf1dee2b0aa96979260fee4230
- MD5 67244ba26d41ab4160b7d127f522a7f3
- SHA1 fa295421b468e9efa85eaf791a82582397d6adda
- SHA512 0799d2f6d472630fd903e1ef82e8dad0dc01b106ba541992b274c89919c24c55f08c7aeb0dc2736f3e602e8724719a7cd150ebbeec88ad1616646c957fb8e6ec
- SSDEEP 49152:Ht8bohaFH12P0SlhcvD+x8Kzosei4jxDbhvmb8z27fh/+MVAGi55R+zckesDnlNv:h
- TLSH T1A7D633215EA66EBE056CD33D30BF1F5D2AE14F51800CE6EB63D5A48723ADB90511B83E
- MD5 SHA1 SHA512 SSDEEP TLSH