donutloader | 252918aaa98f25a1cc128e8eebb27905ded606d4eb04285abbf5344ff51947ba

Analysis

max time kernel
101s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
07/09/2025, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
START 3.exe
Size 156KB
Sample250907-2hecraymv7
SHA256 252918aaa98f25a1cc128e8eebb27905ded606d4eb04285abbf5344ff51947ba
MD5 34094725fa790576456fd43f674d3b95
SHA1 cb12b12c23b7d6ed3b512f923bea1b560de2fdba
SHA512 c75cc1dde534b8ece00c57c5e0d3ffa95d60fe400d3ffd78bc44c12ffb954bb496c45d94cdef01396ca23d31aa7f510c2cc375452ea440617e79ab1cf44bada3
SSDEEP 3072:gGPLWFdkhbgNpJNuL1sV+LPL6xnQ+vCjL5qzHgv4PtV5cU1D:gGPLWFdkhburoyV+DOStLozAA3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery donutloader rhadamanthys loader stealer

Malware Config

Signatures

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2352-38-0x0000000003150000-0x00000000031E8000-memory.dmp	family_donutloader

Detects Rhadamanthys Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2352-39-0x0000000003760000-0x0000000003B60000-memory.dmp	family_rhadamanthys_payload

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Downloads MZ/PE file 3 IoCs

flow	pid	Process
1	6060	START 3.exe
3	5436	pr0drhxw.exe
4	3516	sy7atmns.exe

Executes dropped EXE 5 IoCs

pid	Process
4552	tjgajdjrg.exe
3516	sy7atmns.exe
5436	pr0drhxw.exe
4808	tjgajdjrg.exe
2352	tjgajdjrg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tjgajdjrg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4808	tjgajdjrg.exe
2352	tjgajdjrg.exe
2352	tjgajdjrg.exe
2352	tjgajdjrg.exe
2352	tjgajdjrg.exe
4808	tjgajdjrg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	tjgajdjrg.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 6060 wrote to memory of 4552	6060	START 3.exe	78
PID 6060 wrote to memory of 4552	6060	START 3.exe	78
PID 4552 wrote to memory of 3516	4552	tjgajdjrg.exe	80
PID 4552 wrote to memory of 3516	4552	tjgajdjrg.exe	80
PID 4552 wrote to memory of 5436	4552	tjgajdjrg.exe	81
PID 4552 wrote to memory of 5436	4552	tjgajdjrg.exe	81
PID 5436 wrote to memory of 4808	5436	pr0drhxw.exe	82
PID 5436 wrote to memory of 4808	5436	pr0drhxw.exe	82
PID 3516 wrote to memory of 2352	3516	sy7atmns.exe	84
PID 3516 wrote to memory of 2352	3516	sy7atmns.exe	84
PID 3516 wrote to memory of 2352	3516	sy7atmns.exe	84

C:\Users\Admin\AppData\Local\Temp\START 3.exe
"C:\Users\Admin\AppData\Local\Temp\START 3.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Users\Admin\AppData\Local\len\tjgajdjrg.exe
  "C:\Users\Admin\AppData\Local\len\tjgajdjrg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\sy7atmns.exe
    "C:\Users\Admin\AppData\Local\Temp\sy7atmns.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Users\Admin\AppData\Local\jjda\tjgajdjrg.exe
      "C:\Users\Admin\AppData\Local\jjda\tjgajdjrg.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2352
- - C:\Users\Admin\AppData\Local\Temp\pr0drhxw.exe
    "C:\Users\Admin\AppData\Local\Temp\pr0drhxw.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\Users\Admin\AppData\Local\nfuk\tjgajdjrg.exe
      "C:\Users\Admin\AppData\Local\nfuk\tjgajdjrg.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pr0drhxw.exe

Path C:\Users\Admin\AppData\Local\Temp\pr0drhxw.exe
Size 156KB
SHA256 6749216cb0606bfc97c9d1b5aa4277b4f7a619f280a9ad723f23eed897000ec4
MD5 1081af57f33a255c27b1b8c3f36c5dd1
SHA1 4f8db23183fbd38e740dfdcfba1987e09870fa88
SHA512 abc4dd1a4dd4fecf87187989c2523666bec1e66ebb735800e8c38491bd1bbf5fd3e94b02a631e94c56dc508701feaae9b4831dd31b1bb18d5abe52320e46658d
SSDEEP 3072:SGPrWt3jRRRPu8geaL1OHLPN1n5A2v8jRjXc/E5LjVh59c/41eyLih:SGPrWt3jRRErFJOHDLK3Rg+LQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sy7atmns.exe

Path C:\Users\Admin\AppData\Local\Temp\sy7atmns.exe
Size 156KB
SHA256 f9f843a7b92a7f836573501affd9e4ed6be4469d36e87908072dbc757396f95c
MD5 08e7dfda2e4ffdbad8fbbcd8a1dbd52a
SHA1 6db4f5c9a5f8a10a506d237e714a0c261dd081a9
SHA512 3cef54fceee2cef47b03b2484e7e30650eb5413845c05765d2c7232924364a5473a3c6e10ceebdfb452b9bd888df5ea0f7cfef63ddfc72605dc783e013326f71
SSDEEP 3072:LGPLWFdkhbeVLJNuL1sV+LPL6xnQ+vCjLgqzHgv4PtVGcU1D:LGPLWFdkhbKroyV+DOStLzzAAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjgajdjrg.exe

Path C:\Users\Admin\AppData\Local\jjda\tjgajdjrg.exe
Size 93KB
SHA256 ba56df1b01eefe74450c57d36aad62838da47823bbb379ab144e9a90bc4b1204
MD5 b37c278096398cd23e0805f94d3573e4
SHA1 c5f8896002a2955144df8f86b2e522e363d3fa28
SHA512 e81d4750fd106a7127e18789bd166ef314dac4c74975a3472acbc0bfae0f832c4a6f1df489cd39451dc4c35e408539fa63e8a7f0bf3dd4671eab33e11ddaf0c2
SSDEEP 1536:K0UMdkltWXjMB/kXmS7ppCi6N3+yrzZzimNpRabAhwnwCq/lhlHZasWlTcdRlkcr:K0UDtAWSyi6N3+y5zimpRa8hwnw1l5kB
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjgajdjrg.exe

Path C:\Users\Admin\AppData\Local\len\tjgajdjrg.exe
Size 11.8MB
SHA256 f329f70c7000acb82538ee62cf50ea47aed39f67f26975a87b996c44a337fab1
MD5 f5aab608c2cb3e70024b60b02c8757ed
SHA1 0088c9b934f381dfea74857dd9548ff48533863f
SHA512 bbeec91721e2dd1cb08e502de0a5f7ea7cba1a427ced64101be21567fb71db118e365aebd207e9b59b62f901b6b757e32646e56e6d79d9cf4a6df45a0cdc236d
SSDEEP 196608:e0E3pxFTTmYicGoU47NA6uHqrJLDYXKlIc:rGDTToU7NlLDYXwIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjgajdjrg.exe

Path C:\Users\Admin\AppData\Local\nfuk\tjgajdjrg.exe
Size 8.2MB
SHA256 7215b48548bba5e5502aa68bb83c51c3fdbb30978e7cd2f5b44898886218d085
MD5 ab4268667765a82a59845319089c8801
SHA1 8958e0b9b47809a91caffe98b2747d17a113e777
SHA512 1e9087ae9da05e8c3c45ef7d9f81208080045a576ac983232ebe44c97889902746f18833e06f34d4959b7bdf4efa2f6bf389af382b7668d439dd051cae8cc888
SSDEEP 196608:2djAE62s8nYvZ0sG5sDXnqhEzpRuq6/pyF0k/:SAEdnKZlDqoayF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2352-38-0x0000000003150000-0x00000000031E8000-memory.dmp

Download

memory/2352-39-0x0000000003760000-0x0000000003B60000-memory.dmp

Download

memory/2352-40-0x0000000003760000-0x0000000003B60000-memory.dmp

Download

memory/2352-41-0x00007FF872540000-0x00007FF872749000-memory.dmp

Download

memory/2352-43-0x0000000075CF0000-0x0000000075F42000-memory.dmp

Download