Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
07/11/2026, 11:16
General
- Target ldplayer.exe
- Size 5.5MB
- Sample261107-ndh89axt4p
- SHA256 c7d3cbb51d516b2cb9aa24084a274c4860005c00e0c83779fdbb38363cad2de5
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
- Modifies security service 2 TTPs 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 15 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Security services 2 TTPs 10 IoCs
Modifies the startup behavior of a security service.
- Drops file in System32 directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ldplayer.exe"C:\Users\Admin\AppData\Local\Temp\ldplayer.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"C:\Users\Admin\AppData\Local\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"2⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Security services
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"C:\Users\Admin\AppData\Local\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Create /F /SC ONLOGON /RL HIGHEST /TN "MicrosoftDiagTrack" /TR "C:\ProgramData\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\ldplayer14_ld_6000_ld.exe"C:\Users\Admin\AppData\Local\Temp\ldplayer14_ld_6000_ld.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Microsoft\MicrosoftDiagTrack\QtsUpdater.exeC:\ProgramData\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\ProgramData\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"C:\ProgramData\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"1⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Modifies Security services
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"C:\ProgramData\Microsoft\MicrosoftDiagTrack\QtsUpdater.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
1Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
heartbeat.cache
2026-11-07T11-17-00_QtsTool.log
MSVCP140.dll
QtsUpdater.exe
QtsVFS.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
cw_trace.log
cw_trace.log
cw_trace.log
cw_trace.log
cw_trace.log
cw_trace.log
cw_trace.log
cw_trace.log
cw_trace.log
cw_trace.log
cw_trace.log
hdp_rebuild_stage.lo
hdp_rebuild_stage.lo
hdp_rebuild_stage.lo
hdp_rebuild_stage.log
hdp_rebuild_stage.log
hdp_rebuild_stage.log
hdp_rebuild_stage.log
hdp_rebuild_stage.log
hdp_rebuild_stage.log
hdp_rebuild_stage.log
hdp_rebuild_stage.log
hs_elev.ok
hs_rt32_f5fd85e0.dll
ardrv.dat
ldplayer14_ld_6000_ld.exe
memory/764-0-0x00007FF6952F0000-0x00007FF695880000-memory.dmp
memory/764-48-0x00007FF6952F0000-0x00007FF695880000-memory.dmp
memory/1200-182-0x00000287B6520000-0x00000287B6528000-memory.dmp
memory/2704-265-0x00007FF864910000-0x00007FF86499E000-memory.dmp
memory/5008-77-0x000001EB1DB80000-0x000001EB1DB89000-memory.dmp
memory/5008-78-0x000001EB1DBD0000-0x000001EB1DBD8000-memory.dmp
memory/5036-266-0x00007FF8649A0000-0x00007FF864A2E000-memory.dmp