Observed telemetry shows that 65% of the lookups for this driver were from Saudi Arabia, indicating it was a primary target.

This sample was compiled in June 2021 and was first observed in the wild in December 2021.īased on the information we have collected so far, we now believe that this driver has been active in the wild since at least mid-2020 and, to the best of our knowledge, has not been reported before. Pivoting again from the used certificates, we found another variant of the WINTAPIX driver with the SRVNET2.SYS name. Pivoting from this sample, we found another variant of this driver with the same name that was compiled around the same time, but it was uploaded to Virus Total in September 2022. This captured sample was compiled in May 2020 but was only uploaded to Virus Total in February of this year. It turned out to be a very interesting sample that we believe is being used in targeted attacks against countries in the Middle East. Since it uses Donut, we decided to analyze it further. The sample that triggered our rule was a driver called WinTapix.sys (which is why we named it WINTAPIX). During our daily threat-hunting process in early February, we encountered a kernel driver that used the Donut tool and caught our attention for further analysis.

NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters. Donut is a position-independent shellcode that loads.

One of the things that we keep an eye out for is tools that use the Donut project. Impact: Allows remote code execution and persistent access to the host (backdoor) and the rest of the network (proxy)Īt Fortinet, we monitor suspicious executables that make use of open-source tools and frameworks.

Fortinet client download