donutloader | 30235049839cd3ddfb7e50e8a58f3d0c2a5dffaa632c671a97de12ed1dfa6a06

Analysis

max time kernel
47s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
09/09/2025, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
926ab7d10da645f08b9d109b5bab77c8_bound_build.exe
Size 11.8MB
Sample250909-tpem4axyew
SHA256 30235049839cd3ddfb7e50e8a58f3d0c2a5dffaa632c671a97de12ed1dfa6a06
MD5 b8b7a103484504636148673a44eca835
SHA1 d5db50217b873976ffbf6e30d21a451d8ddac1ac
SHA512 53dfea39ace76ce0487622daa05dd9e15e0d148f3549e485d0fbebf9fb92274e2d1a1266aab06afdc99142e75abfe2f839b83184157ba3136425fb7dd2392b88
SSDEEP 196608:e0E3pxFTTmYicGoo47NA6wPawJLDYXKlIZ:rGDTToE7NGLDYXwIZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery donutloader rhadamanthys loader stealer

Malware Config

Signatures

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5900-31-0x0000000003CA0000-0x0000000003D38000-memory.dmp	family_donutloader

Detects Rhadamanthys Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5900-32-0x0000000004300000-0x0000000004700000-memory.dmp	family_rhadamanthys_payload

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Downloads MZ/PE file 2 IoCs

flow	pid	Process
1	2012	vfnxgfd4.exe
2	5744	5dhvxn5b.exe

Executes dropped EXE 4 IoCs

pid	Process
5744	5dhvxn5b.exe
2012	vfnxgfd4.exe
5900	tjgajdjrg.exe
2064	tjgajdjrg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tjgajdjrg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2064	tjgajdjrg.exe
2064	tjgajdjrg.exe
5900	tjgajdjrg.exe
5900	tjgajdjrg.exe
5900	tjgajdjrg.exe
5900	tjgajdjrg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	tjgajdjrg.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 5744	5816	926ab7d10da645f08b9d109b5bab77c8_bound_build.exe	79
PID 5816 wrote to memory of 5744	5816	926ab7d10da645f08b9d109b5bab77c8_bound_build.exe	79
PID 5816 wrote to memory of 2012	5816	926ab7d10da645f08b9d109b5bab77c8_bound_build.exe	80
PID 5816 wrote to memory of 2012	5816	926ab7d10da645f08b9d109b5bab77c8_bound_build.exe	80
PID 5744 wrote to memory of 5900	5744	5dhvxn5b.exe	81
PID 5744 wrote to memory of 5900	5744	5dhvxn5b.exe	81
PID 5744 wrote to memory of 5900	5744	5dhvxn5b.exe	81
PID 2012 wrote to memory of 2064	2012	vfnxgfd4.exe	83
PID 2012 wrote to memory of 2064	2012	vfnxgfd4.exe	83

C:\Users\Admin\AppData\Local\Temp\926ab7d10da645f08b9d109b5bab77c8_bound_build.exe
"C:\Users\Admin\AppData\Local\Temp\926ab7d10da645f08b9d109b5bab77c8_bound_build.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Users\Admin\AppData\Local\Temp\5dhvxn5b.exe
  "C:\Users\Admin\AppData\Local\Temp\5dhvxn5b.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Users\Admin\AppData\Local\qkee\tjgajdjrg.exe
    "C:\Users\Admin\AppData\Local\qkee\tjgajdjrg.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5900
- C:\Users\Admin\AppData\Local\Temp\vfnxgfd4.exe
  "C:\Users\Admin\AppData\Local\Temp\vfnxgfd4.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\law\tjgajdjrg.exe
    "C:\Users\Admin\AppData\Local\law\tjgajdjrg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5dhvxn5b.exe

Path C:\Users\Admin\AppData\Local\Temp\5dhvxn5b.exe
Size 156KB
SHA256 eb5dc6442d4010b82bf78ea023d9bf1dc6a00c0a3eb07430f0829e25211a462d
MD5 d9ec9213765e8b72621b089029cbc348
SHA1 02b74d109d0f4a36e16d09d559de3c4fac6ae8fb
SHA512 fdf79b60efd34c6ebe248aa0e1766e5c82ca3b710ad722998755e4dc497b7a5c7783eaf3cf6e7a54e1983f5767a6cfdf4c340cb1b079980418fba024e7ef04b4
SSDEEP 3072:8GPLWFdkhbeVLJNuL1sV+LPL6xnQ+vCjLhqzHgv4PtVFcU1D:8GPLWFdkhbKroyV+DOStLwzAAT
MD5 SHA1 SHA512 SSDEEP

Submit Download

vfnxgfd4.exe

Path C:\Users\Admin\AppData\Local\Temp\vfnxgfd4.exe
Size 156KB
SHA256 3279507d04952f48bbaab30171c864f59ff3d655bd554a06b5798e5800ea3964
MD5 83ee47bb6081269a112f364c6184e519
SHA1 0d892168c3007a973a9a523bfa450545c12e351b
SHA512 2f75992968f03e7d4c3bb96eabb1ffcccb366ce3dd8e2f3d95f7e273f92a0c528ffbbcbe290df827db58ae0ae6ec6241e984680d6dc9f3447460d4512dd19f73
SSDEEP 3072:sGPrWt3jRRRPu8geaL1OHLPN1n5A2v8jR+Xc/E5LjVP59c/41eyLih:sGPrWt3jRRErFJOHDLK3Rj+pQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjgajdjrg.exe

Path C:\Users\Admin\AppData\Local\law\tjgajdjrg.exe
Size 8.3MB
SHA256 556d8ed53e1015b4d40383198e5a787e022fa26dc132820fc053e55ec28317b7
MD5 76c0b9fe40658d4157264aeea2fcd13b
SHA1 c3b48cc82bcae15c71f5897958efe28c61b115f1
SHA512 4d53d2df300120fc768090b6de927df999a870f8049ae2b334632159991f87e3c0aeeb6a2b61b9069cd1e5e8286e4638795eccff7ac69c0a61a33a07409ba42e
SSDEEP 196608:F42k62s8nYvZ0sG5sDXnqhEzpRuq6/pyFoF:K2kdnKZlDqoayF
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjgajdjrg.exe

Path C:\Users\Admin\AppData\Local\qkee\tjgajdjrg.exe
Size 93KB
SHA256 293ab68de0e343a7feb0cf35c7c266125e2f7bbafeed2849820da3ce51024d6b
MD5 f8d2e00ec32f7fb56f6411211abc9684
SHA1 95b1f6e631e803236faffaeed5bee05dd1fbd9b9
SHA512 b08ec8dbe375cd9b3956a7bb0294e9a35fd1ba19d531bac3cc3e8be524c2be5c7a5894f50f94e5e02b603de02c53ca9aacfad45b6ec75c2e8b254e035b8514cc
SSDEEP 1536:R0UMdkltWXjMB/kXmS7ppCi6N3+yrzZzimNpRabAhwnwCq/lrlHZasWlTcdR4kcr:R0UDtAWSyi6N3+y5zimpRa8hwnw3l5kU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5900-31-0x0000000003CA0000-0x0000000003D38000-memory.dmp

Download

memory/5900-32-0x0000000004300000-0x0000000004700000-memory.dmp

Download

memory/5900-33-0x0000000004300000-0x0000000004700000-memory.dmp

Download

memory/5900-34-0x00007FFE90C00000-0x00007FFE90E09000-memory.dmp

Download

memory/5900-36-0x0000000074D60000-0x0000000074FB2000-memory.dmp

Download