Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 07:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kvpins64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
kvpins64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
kvpvbsext64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
kvpvbsext64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
kvpvbsext64_orig.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
kvpvbsext64_orig.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target kvpvbsext64.dll
- Size 12.8MB
- Sample261102-jrncxaee39
- SHA256 e28a6f4d8a08c79cb8d198263e819dc339634da08faf8b97d162d95d34cb3f42
- MD5 8506ace59fd90a0845ff76018ac076b2
- SHA1 fa693dcb2d8cc682e8da6417e5f47ec82ea9007f
- SHA512 385cd41fe779a99e8f7ca23e59c6c20a11e9f35f420252a812f4792687012ec33e9820e9f229158fceeee8edd71017686e9447c85197f82e9a9a8a597fec25aa
- SSDEEP 393216:O8+QhOxrvXOKjZuArEdXnMAc03NmwswqBMVGsIX0q:O/DxrvXOauMEd/c0MwqBsGsI
- TLSH T1A1D633D28517B4C7C8BBE07F8EC3AEF1239E67D44578822FEE0586C530851D29DA8766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral3/memory/3068-25-0x0000013612680000-0x000001361301E000-memory.dmp family_donutloader - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 3068 cmd.exe - Executes dropped EXE 1 IoCs
pid Process 116 rundll32.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe 3068 cmd.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3068 cmd.exe Token: SeLockMemoryPrivilege 3068 cmd.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3068 cmd.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5492 wrote to memory of 3068 5492 rundll32.exe 86 PID 5492 wrote to memory of 3068 5492 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\kvpvbsext64.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" --dec "C:\Users\Public\HostSvc\config_enc.json"2⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3068
-
-
C:\Users\Public\HostSvc\rundll32.exeC:\Users\Public\HostSvc\rundll32.exe1⤵
- Executes dropped EXE
PID:116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\HostSvc\_stage.log
- Size 802B
- SHA256 2575ff0d2d92a6c91e713dcde441bd7647044262c573613f5a93d914483b605b
- MD5 0c8574aceab8d96f56dcf5ca7533744d
- SHA1 5b20c6543cbb099d59dce9a08e9836232dc9a949
- SHA512 c986e4dc4709fe9a0afe9c337724d98604242d2697ad70c5c1f6448c7bb13d33e7b61514a20dea1d6fb76d7cf756786c93563135a40a51d1907cacd70f9ce960
- TLSH T110014C04FDB1D166E1A1A3671D1007BA36E7F5056D9AC12BE78F80CC20AB9CF5313174
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\config_enc.json
- Size 2KB
- SHA256 67c39225831a8e2dc490511285b5d92ec56cee246d270fde63ce924d44dd94a0
- MD5 f8361e5bc468c5256ff9fba2ccf9f2da
- SHA1 25705083b433162af6e3810669e8209b7006fb5f
- SHA512 6ef5be2d726fc6971a895a518c349dc64afd95874f8f3b48d211f85bf76f2d81af8b47d74c05e132072978928aab7890088f51fa3bba6b0aae26482aa129bb5f
- TLSH T159512A00060BE681B4D0703DD1580625CFF5D6DD78F29EF06E9E88AFFD655133A6889D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\rundll32.exe
- Size 70KB
- SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
- MD5 ef3179d498793bf4234f708d3be28633
- SHA1 dd399ae46303343f9f0da189aee11c67bd868222
- SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
- SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
- TLSH T16B630BC9A66460F4E077953444734E099272BC22D7625ADF54F0F17C0FF36E0A93AAAB
- MD5 SHA1 SHA512 SSDEEP TLSH