DonutLoader: what defenders need to know about hidden injection chains

TL;DR: A highly obfuscated Windows batch script using scheduled-task persistence, renamed PowerShell, AMSI and ETW tampering, and shellcode injection into explorer.exe to run a memory-resident .NET implant while reducing detection shows the DonutLoader campaign, according to Aryaka's analysis.

Editorial analysis by NHI Mgmt Group, based on content published by Aryaka: “Beyond the Batch File: A Look at a Multi-Stage DonutLoader Infection Chain”.

Key questions

Q: What breaks when Windows loaders hide in renamed PowerShell and scheduled tasks?

A: Renamed interpreters and scheduled tasks break simple allowlisting and event triage because the execution path looks like routine system activity.

Q: Why do process injection and telemetry tampering make loader malware harder to contain?

A: Process injection moves malicious code into a trusted host, while AMSI and ETW tampering reduce the logs and content inspections that would normally expose it.

Q: What are the signs that a Windows loader is moving toward in-memory execution?

A: Look for batch scripts that unpack payloads, create hidden staging directories, launch renamed interpreters, and then generate unusual memory activity in trusted processes.

Practitioner guidance

• Hunt for hidden staging directories and renamed binaries Prioritise ProgramData paths, non-standard PowerShell names, and unusual script launch chains that do not match normal administration patterns.
• Monitor for scheduled-task persistence at logon Review scheduled tasks that execute scripts or interpreters at user logon, especially when they point to hidden directories or renamed executables.
• Correlate process injection with memory-resident execution Look for cross-process memory writes, private executable memory, and explorer.exe as a host for unusual child activity.

Bottom line: DonutLoader combines obfuscated scripting, persistence, and memory injection to make a Windows implant harder to see and harder to remove.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →