General
- Target https://tr.ee/d1AGHz
- Sample261110-j9f2js1vbx
Score
10/10
Malware Config
Targets
-
- Target https://tr.ee/d1AGHz
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
Suspicious use of NtCreateUserProcessOtherParentProcess
Looks for VirtualBox Guest Additions in registry
Looks for VMWare Tools registry key
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Modify Registry
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1