General
- Target mod_analysis.bin
- Size 1.1MB
- Sample261102-mns1rsswg1
- SHA256 684835fc6ebdc28c2b322ae074d6468f2699e442c534713b4853b8a81c1d08dc
Malware Config
Targets
-
- Target mod_analysis.bin
- Size 1.1MB
- SHA256 684835fc6ebdc28c2b322ae074d6468f2699e442c534713b4853b8a81c1d08dc
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1