donutloader | 1b403baba0d76ade77afeeeae987f0f9445b930192cab01e1d0b2bc335698bf0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
19/01/2026, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.js
Size 6.5MB
Sample260119-nyndpscs5a
SHA256 1b403baba0d76ade77afeeeae987f0f9445b930192cab01e1d0b2bc335698bf0
MD5 b5010347a122eed06a59afa97974d5f9
SHA1 af8703eab175946635699672a5ce08382612468e
SHA512 106dce1b7d687ad3266c46c32f56effd78285ac1cb4cd00e27ed9d8e9be839d1425d31aea9fff3f8e05ff64852f22bf04766140bfc2ba01a29ed5a760de011e9
SSDEEP 98304:nAc8oFbUbS5mrtiYoAiz2IkLAFy52XcVETwPRr4UU2BdDKAVnOqZGrq7:nAToFEkKiKTAFg2MDLp+Zrq7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery execution donutloader loader

Malware Config

Signatures

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5084-14-0x0000000004630000-0x0000000005630000-memory.dmp	family_donutloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4820-22-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3612-24-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3612-24-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

Executes dropped EXE 1 IoCs

pid	Process
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2271354545-1345258274-2018814899-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rmclient.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5084 set thread context of 4764	5084	colorcpl.exe	79
PID 5084 set thread context of 3612	5084	colorcpl.exe	81
PID 5084 set thread context of 4820	5084	colorcpl.exe	82

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmclient.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4820	rmclient.exe
4820	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe
4764	rmclient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	rmclient.exe
Token: SeImpersonatePrivilege	4764	rmclient.exe
Token: SeImpersonatePrivilege	4764	rmclient.exe
Token: SeImpersonatePrivilege	4764	rmclient.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe
8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 8	4780	wscript.exe	77
PID 8 wrote to memory of 5084	8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe	78
PID 8 wrote to memory of 5084	8	JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe	78
PID 5084 wrote to memory of 4764	5084	colorcpl.exe	79
PID 5084 wrote to memory of 5708	5084	colorcpl.exe	80
PID 5084 wrote to memory of 3612	5084	colorcpl.exe	81
PID 5084 wrote to memory of 4820	5084	colorcpl.exe	82

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\3.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Public\Libraries\JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe
  "C:\Users\Public\Libraries\JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe" C:\Users\Public\Libraries\JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.png
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\Syswow64\colorcpl.exe
    C:\Windows\Syswow64\colorcpl.exe
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\SysWOW64\rmclient.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jrrlcwulrvhswsdednubkugxoekpc"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4764
  - - C:\Windows\SysWOW64\rmclient.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\tlewcofffdzfgyzqmyhcnzbgxktydsnd"
      4⤵
      PID:5708
  - - C:\Windows\SysWOW64\rmclient.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\tlewcofffdzfgyzqmyhcnzbgxktydsnd"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:3612
  - - C:\Windows\SysWOW64\rmclient.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\enjo"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jrrlcwulrvhswsdednubkugxoekpc

Path C:\Users\Admin\AppData\Local\Temp\jrrlcwulrvhswsdednubkugxoekpc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC

Path C:\Users\Public\Libraries\JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC
Size 526KB
SHA256 3042972568c5c12cfe7f315111245aa03e2989299db07a3af69c0668b0682a17
MD5 943622e07576d738232d0f0039f988b4
SHA1 b37571277c755e4d5ae22c157e0b96b5d6b970a6
SHA512 ae0a30e157e61b9e7df39d780af285305eb881826831265ec114743b7ca3611f18163a3bc06a7027d76c448dfb482ed8b57af761b9f5159631e8f83c7a7b1978
SSDEEP 12288:rSstNcRz3VDm/5v5aDF9cid7HFmZOkNjCU41xJNun5hLVL:W8Nct3VDQJMF9cljNj/axqv
TLSH
T1BAB423B7FD2DBCDD663BB0B8550EDA48E98AF292C842548677F027DB016CCB10765883
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe

Path C:\Users\Public\Libraries\JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.png

Path C:\Users\Public\Libraries\JSWUTUKSBDOFRAZSOVZORGPPHGDVHWTGUPFUUHEJOAKZUUWAFLJHWHC.png
Size 26KB
SHA256 ddfc1be2a33466ddda676cf5293171cbde18d6582bfe707ae8b71640d4f1356d
MD5 61b52f3be79c5b911aefb41f6213fb45
SHA1 615721783d061d529e2f743aeb7aa7f0d66ea7be
SHA512 1a936869220540413c1785acd3232d8ef1a3db83ea073a64f17aec7da54ed967d6a6249bb83e0c8efb5fc411ca33905c76d2b6500e7c9eeb1dcfa2294212dc40
SSDEEP 192:8IAfKgQ5WTNTmaQZNArUuAAdGAAnxbDoQZNoDiSwfX/d84aabQ9q2rLPQE5/rFEO:VAfKgCdjJfVXajgDtTEss/
TLSH
T19AC251CBC0AF513F42A61DE77866F4758809E5A8C359A0D1FAE733E5522C06900977BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3612-24-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4764-26-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4764-15-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4820-22-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4820-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5084-14-0x0000000004630000-0x0000000005630000-memory.dmp

Download

memory/5084-28-0x000000002C2F0000-0x000000002C309000-memory.dmp

Download

memory/5084-32-0x000000002C2F0000-0x000000002C309000-memory.dmp

Download

memory/5084-31-0x000000002C2F0000-0x000000002C309000-memory.dmp

Download

memory/5708-17-0x0000000000410000-0x0000000000472000-memory.dmp

Download