Aryaka Threat Research Lab examined a highly obfuscated Windows batch script that delivers Donut shellcode and installs a memory-resident .NET implant inside a legitimate Windows process.

Threat Campaign Overview

The infection begins with a malicious batch script that uses variable substitution, randomized labels, control-flow obfuscation, and junk instructions to hide its behavior. It performs environment checks to evade analysis systems before creating a hidden staging directory at C:\ProgramData\IntelDriver. The malware reconstructs embedded payloads and uses a renamed copy of powershell.exe, named HDVz.exe, to execute subsequent stages. Persistence is established via a scheduled task that silently launches the malware at user logon. The recovered PowerShell loader primarily injects Donut shellcode into explorer.exe, allowing the final .NET implant to run in memory within a trusted Windows process.

Key Findings

See below for characteristics of the DonutLoader Campaign

• Anti-analysis checks based on usernames, filesystem artifacts, and available system memory: The malware checks for signs of virtual machines, sandboxes, or analyst environments by inspecting usernames, specific files, and system memory before executing.
• Donut shellcode and encrypted PowerShell content disguised as image file extensions: The payload uses Donut-generated shellcode and encrypted PowerShell scripts hidden behind image-like extensions to evade detection and conceal malicious content.
• A renamed PowerShell binary used as a concealed execution vehicle: Instead of launching the standard PowerShell executable, the malware renames it to make malicious execution appear less suspicious and bypass simple security checks.
• Scheduled-task persistence via a VBS launcher: The malware creates a scheduled task that executes a Visual Basic Script (VBS), ensuring it automatically runs again after a system reboot or user logon.
• Shellcode injection into explorer.exe, with additional fallback targets: The malware injects malicious shellcode into the trusted explorer.exe process to hide its activity, using alternative processes if the primary target is unavailable.
• AMSI and ETW tampering to reduce security visibility: The malware disables or bypasses AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) to reduce the likelihood of detection by security tools.
• Obfuscated .NET components associated with command-and-control activity:
  The malware uses heavily obfuscated .NET code to conceal the functionality that communicates with command-and-control (C2) servers.
• Telegram-based execution notification and outbound communication with remote infrastructure: Upon execution, the malware sends status notifications via Telegram and communicates with remote servers to receive commands or transmit stolen information.

Notable Research Finding: Custom Injection Tracking

A distinctive finding was the custom memory marker: DE AD BE CA FE BA EF. The malware places this marker immediately before the injected shellcode and scans candidate processes for it before injection. This allows the loader to identify previously injected processes, prevent duplicate shellcode deployment, and reduce the risk of process instability. The marker also provides defenders with a valuable memory-based threat-hunting indicator.

Operator Communication and Command-and-Control Activity

During execution, curl.exe sends an HTTP POST request to the Telegram Bot API’s /sendMessage endpoint, using a hardcoded bot token and chat ID. This request includes an operator notification confirming successful malware execution and indicating that an operator-controlled Telegram channel is used to monitor active infections. After process injection, the .NET implant attempts to connect to 167.88.167.9:8356 via outbound TCP, suggesting a dedicated command-and-control channel. Since the remote infrastructure was unavailable during analysis, the operator tasks and full post-infection capabilities could not be assessed.

Defensive Considerations

Organizations are advised to monitor for renamed PowerShell binaries, concealed directories within ProgramData, suspicious scheduled tasks, script execution from user-writable locations, process injection activities, private executable memory, and alterations to AMSI or ETW functions. Endpoint activities should also be correlated with anomalous Telegram Bot API requests and outbound connections originating from trusted processes such as explorer.exe. Behavioral correlation offers a more robust detection approach than relying solely on filenames, hashes, IP addresses, or other individual indicators.

Complete Technical Analysis

The complete Aryaka Threat Research Lab report provides a detailed technical breakdown of the infection chain, including:

• Batch-script deobfuscation and control-flow recovery
• Anti-analysis and environment-validation behavior
• Embedded payload reconstruction and decryption
• PowerShell loader analysis
• Scheduled-task persistence
• Donut shellcode recovery
• Process-injection workflow
• Injection-marker analysis
• AMSI and ETW tampering
• Recovered .NET implant analysis
• Telegram notification and command-and-control activity
• Indicators of compromise
• MITRE ATT&CK mapping
• Defensive and threat-hunting guidance

Download the full report here: Donutloader multi stage loader report