Beyond the Batch File

Analysis of a Multi-Stage DonutLoader Infection Chain

Modern malware increasingly relies on multi-stage execution and memory-resident techniques to evade traditional security controls. In this report, Aryaka Threat Labs analyzes a heavily obfuscated Windows batch script that delivers a sophisticated DonutLoader infection chain. The malware employs process injection, dynamic API resolution, AMSI bypass, ETW tampering, and in-memory execution to deploy a managed .NET implant into explorer.exe, while minimizing forensic artifacts and endpoint visibility.

Through detailed reverse engineering, this report uncovers the complete execution flow—from initial script deobfuscation and control-flow recovery to payload deployment, defense evasion, and command-and-control communication. It also highlights the malware’s custom injection tracking mechanism, demonstrating an advanced level of engineering uncommon in script-based loaders.

Key Insights You’ll Gain from This Report

• Analysis of a multi-stage DonutLoader infection chain.
• Techniques used to obfuscate Windows batch scripts.
• Step-by-step deobfuscation and control-flow recovery.
• How Donut shellcode enables memory-resident .NET execution.
• Process injection into explorer.exe and dynamic API resolution.
• AMSI bypass and ETW tampering techniques for defense evasion.
• Custom process injection tracking using the DE AD BE CA FE BA EF marker.
• Telegram-based victim telemetry reporting and C2 communication workflow.
• Practical detection opportunities and defensive recommendations for security teams.