donutloader | 7108d2c7b985267bec554335b4a91b8f756b4d1eca463d04051b4d65b065d587

General

Target
encrypted_msb_9987.js
Size 3.4MB
Sample261102-xftmfaex8l
SHA256 7108d2c7b985267bec554335b4a91b8f756b4d1eca463d04051b4d65b065d587
MD5 9e1a284544627e3a41cc9b95d8c67423
SHA1 9a66ee806640ae61ecfdbe21f718dc172e58cc0d
SHA512 6fad28ffa52c393571e424fefcfc199d6ee7c0d347b5c534aa030731d0cdc83fa17453b1aa0e7adf69c71bcbe55a4b20faa28319bb67abc9a1cd6522581292d7
SSDEEP 49152:prJJ4Ac2GcQKTO4aWfd1gJFq7Q48tS6PArxs8iS4YS6QRtj+CBZhMW7Ix1KlX2/g:K
TLSH
T108F5011E5F260D2D8225FACF7E7B5F5DA4F7D9ABDC98F900CE08A3174290352AB44A50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4264-11-0x00000000007D0000-0x00000000007EE000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
3412	mwdhtftg.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1924	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mwdhtftg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexpress.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1924	cmd.exe
2348	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2348	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	iexpress.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3412	4140	wscript.exe	89
PID 4140 wrote to memory of 1924	4140	wscript.exe	90
PID 1924 wrote to memory of 2348	1924	cmd.exe	92
PID 3412 wrote to memory of 4264	3412	mwdhtftg.exe	93
PID 3412 wrote to memory of 4264	3412	mwdhtftg.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\encrypted_msb_9987.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Roaming\SecurityHealth\mwdhtftg.exe
  "C:\Users\Admin\AppData\Roaming\SecurityHealth\mwdhtftg.exe" "C:\Users\Admin\AppData\Roaming\SecurityHealth\ehuojfwe.au3"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\iexpress.exe
    C:\Windows\SysWOW64\iexpress.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 9 127.0.0.1 >nul & rd /s /q "C:\Users\Admin\AppData\Roaming\SecurityHealth"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\PING.EXE
    ping -n 9 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JGFFDDERGH

Path C:\Users\Admin\AppData\Roaming\SecurityHealth\JGFFDDERGH
Size 118KB
SHA256 8faccbe1c735ccfb419b74a8271d3148be1ff15f3f5500570f95df5b7ad471d4
MD5 1ad45ec70ab14413e3d15131957ac0af
SHA1 d8cd287529b09cc8ce373012721500c9e0f1ad01
SHA512 cbdaddc95deff7473e57f18f63285e026d80231400338febc035a3dee9eaa874a5f64d3abc1931ec2e006832759ad4867530e920323a7fb3ae72a7fa34f4885e
SSDEEP 3072:LjcOPnciG8vtp+GV6GJDz1k1QqImbifSpUQLl:/5Pq8vtRrJTqJyiv
TLSH
T1ADC3129118E0FC1CE4D6BBD8F2F2CCE9889A7D49B24BD8A571ED194B4D99404C4C8F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ehuojfwe.au3

Path C:\Users\Admin\AppData\Roaming\SecurityHealth\ehuojfwe.au3
Size 10KB
SHA256 436f2083f6960dd189b5c076a1919af7fa6c8d31dca16ff6b45ec843ddb475c6
MD5 b906b38db79c35823eddb777ffac9195
SHA1 62ea7f61fd6ccb6229308a4253fba9a682fa9fdb
SHA512 d3d49ed79cedb3a606712627f22fad0fcf6f30a73a6e0324728a682d98f9e140c2d9cd76150507c6e25b7ca714b806a3362b885e25dc717ffd709f6c97a58145
SSDEEP 96:XUeYeBw20dahGCGIGIGIGIGIGIGIGNNMJJA4JFGIGcAi7G4EmgvW5vuEgvuEGNs4:hwsAmKq
TLSH
T1FE3230C85E5ABFFCDAC2C855074D9B4980E029BA5B3480E9E978F00C417B5BD5AC79A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwdhtftg.exe

Path C:\Users\Admin\AppData\Roaming\SecurityHealth\mwdhtftg.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-11-0x00000000007D0000-0x00000000007EE000-memory.dmp

Download

memory/4264-13-0x0000000004D90000-0x0000000004DAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads