Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 07:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kvpins64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
kvpins64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
kvpvbsext64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
kvpvbsext64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
kvpvbsext64_orig.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
kvpvbsext64_orig.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target kvpvbsext64.dll
- Size 12.8MB
- Sample261102-jrncxaee39
- SHA256 e28a6f4d8a08c79cb8d198263e819dc339634da08faf8b97d162d95d34cb3f42
- MD5 8506ace59fd90a0845ff76018ac076b2
- SHA1 fa693dcb2d8cc682e8da6417e5f47ec82ea9007f
- SHA512 385cd41fe779a99e8f7ca23e59c6c20a11e9f35f420252a812f4792687012ec33e9820e9f229158fceeee8edd71017686e9447c85197f82e9a9a8a597fec25aa
- SSDEEP 393216:O8+QhOxrvXOKjZuArEdXnMAc03NmwswqBMVGsIX0q:O/DxrvXOauMEd/c0MwqBsGsI
- TLSH T1A1D633D28517B4C7C8BBE07F8EC3AEF1239E67D44578822FEE0586C530851D29DA8766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral4/memory/3388-22-0x000001E154320000-0x000001E154CBE000-memory.dmp family_donutloader - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3388 cmd.exe - Executes dropped EXE 1 IoCs
pid Process 6124 rundll32.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe 3388 cmd.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3388 cmd.exe Token: SeLockMemoryPrivilege 3388 cmd.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3388 cmd.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3444 wrote to memory of 3388 3444 rundll32.exe 89 PID 3444 wrote to memory of 3388 3444 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\kvpvbsext64.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" --dec "C:\Users\Public\HostSvc\config_enc.json"2⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3388
-
-
C:\Users\Public\HostSvc\rundll32.exeC:\Users\Public\HostSvc\rundll32.exe1⤵
- Executes dropped EXE
PID:6124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\HostSvc\_stage.log
- Size 802B
- SHA256 50047aae9d5b5822f8e29db8962760de7b2b2612b91b94a9d9e94ebbf73c5129
- MD5 09ff21cd4ce124b90a950298f5e4e0a5
- SHA1 df9c20f1eb5c266cf62061b4e3d72d18864565b9
- SHA512 de8ee9ebbba1d4445f1318db0c946f4293eed9ac1dc3677ed80b408e78bc04aca5aebf143400b4fb56bf14376cb267e87bd1457404ee781cacf542f97033bac9
- TLSH T1CD016B08FDB0D176E1A1A3531E100BBA35EBF5052C9E822AD69A81CD10A78CF9303074
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\config_enc.json
- Size 2KB
- SHA256 67c39225831a8e2dc490511285b5d92ec56cee246d270fde63ce924d44dd94a0
- MD5 f8361e5bc468c5256ff9fba2ccf9f2da
- SHA1 25705083b433162af6e3810669e8209b7006fb5f
- SHA512 6ef5be2d726fc6971a895a518c349dc64afd95874f8f3b48d211f85bf76f2d81af8b47d74c05e132072978928aab7890088f51fa3bba6b0aae26482aa129bb5f
- TLSH T159512A00060BE681B4D0703DD1580625CFF5D6DD78F29EF06E9E88AFFD655133A6889D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\HostSvc\rundll32.exe
- Size 88KB
- SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
- MD5 025b13bf5652712d9b596e6766a9c386
- SHA1 def4011b5536983285472ba75c22c6a2410edf6a
- SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
- SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
- TLSH T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
- MD5 SHA1 SHA512 SSDEEP TLSH