Analysis
- max time kernel
185s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 15:02
General
- Target filezilla.exe
- Size 4.1MB
- Sample261102-sefa7sfd94
- SHA256 84ade0a797ffab4771eb4b0521b4404ec0be86e91824bbe0dafb69c099d74828
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filezilla.exe"C:\Users\Admin\AppData\Local\Temp\filezilla.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2476-0-0x00007FF7CD8A0000-0x00007FF7CDCC8000-memory.dmp
memory/2476-1-0x00000129DFF50000-0x00000129E06FC000-memory.dmp
memory/2476-32-0x00000129E5DE0000-0x00000129E8DA8000-memory.dmp
memory/2476-39-0x00007FFB24210000-0x00007FFB242DA000-memory.dmp
memory/2476-37-0x00007FFB2AD50000-0x00007FFB2ADB7000-memory.dmp
memory/2476-34-0x00007FF7CD8A0000-0x00007FF7CDCC8000-memory.dmp
memory/2476-52-0x0000000071320000-0x0000000071349000-memory.dmp
memory/2476-49-0x00007FFB29070000-0x00007FFB290C9000-memory.dmp
memory/2476-35-0x00007FFB242E0000-0x00007FFB24389000-memory.dmp
memory/2476-42-0x00007FFB2AAD0000-0x00007FFB2AAFB000-memory.dmp
memory/2476-38-0x00007FFB16250000-0x00007FFB16374000-memory.dmp
memory/2476-56-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/2476-57-0x00000129DFF50000-0x00000129E06FC000-memory.dmp
memory/2476-55-0x00007FFB11CF0000-0x00007FFB11F23000-memory.dmp
memory/2476-47-0x00007FFB11F30000-0x00007FFB12442000-memory.dmp
memory/2476-41-0x00007FFB16070000-0x00007FFB16242000-memory.dmp
memory/2476-54-0x00007FFB1AFB0000-0x00007FFB1AFEE000-memory.dmp
memory/2476-53-0x00007FFB23B40000-0x00007FFB23B80000-memory.dmp
memory/2476-51-0x00007FFB1D380000-0x00007FFB1D3C6000-memory.dmp
memory/2476-50-0x00007FFB267E0000-0x00007FFB267F1000-memory.dmp
memory/2476-48-0x00007FFB1D420000-0x00007FFB1D4C4000-memory.dmp
memory/2476-36-0x00007FFB29240000-0x00007FFB293B4000-memory.dmp
memory/2476-46-0x00007FFB290D0000-0x00007FFB290E2000-memory.dmp
memory/2476-45-0x00007FFB12450000-0x00007FFB12681000-memory.dmp
memory/2476-44-0x00007FFB2AA90000-0x00007FFB2AAC4000-memory.dmp
memory/2476-43-0x00007FFB291F0000-0x00007FFB29236000-memory.dmp
memory/2476-40-0x00007FFB25EF0000-0x00007FFB25F76000-memory.dmp
memory/2476-66-0x00007FFB16070000-0x00007FFB16242000-memory.dmp
memory/2476-72-0x00007FFB11F30000-0x00007FFB12442000-memory.dmp
memory/2476-118-0x00007FFB11F30000-0x00007FFB12442000-memory.dmp
memory/2476-187-0x00007FFB11F30000-0x00007FFB12442000-memory.dmp
memory/2476-256-0x00007FFB11F30000-0x00007FFB12442000-memory.dmp