donutloader | ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21.ps1
Size 88KB
Sample260424-dd779sdv5t
SHA256 ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21
MD5 3de3372412fbc7fad69e7e94811200fe
SHA1 b710b72a818497e58f691ca499325585724d5ac1
SHA512 081cfd7958dea9f16b8a032a79f44423cad233b18c7b7f88d146a2e15c32ae4d15fabae71f0d0c01d16390b35a4cfb58f34df20573ff055dd9bc9c7fb28e0a29
SSDEEP 1536:iqEdeLu+4kWF4IfSUFtwhQLaHstdQ7blzESTmULCtLAZqpVC8u36g:VEdeLu+4zHZWhQLvkVJTNu1IEbu36g
TLSH
T117930230B2526ED10A16E6FDA59BBB847A5283FB40577F4134E460E81F87640613BE7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution donutloader xworm loader rat trojan

Malware Config

Extracted

Family

xworm

Version

198.23.177.219:4445

Mutex

19UxITJDrgiOdo47

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/3212-41-0x0000000002AA0000-0x0000000002AB0000-memory.dmp	family_xworm
behavioral1/memory/3212-44-0x0000000003180000-0x000000000318E000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/3212-41-0x0000000002AA0000-0x0000000002AB0000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4900	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3212	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeDebugPrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4788	4900	powershell.exe	85
PID 4788 wrote to memory of 2080	4788	csc.exe	86
PID 4900 wrote to memory of 2652	4900	powershell.exe	87
PID 2652 wrote to memory of 5056	2652	csc.exe	88
PID 4900 wrote to memory of 3212	4900	powershell.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xzjgk42f\xzjgk42f.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES601C.tmp" "c:\Users\Admin\AppData\Local\Temp\xzjgk42f\CSC37B3F3F5570D4C548CA7EF90303EAAC5.TMP"
      4⤵
      PID:2080
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tgisnr2e\tgisnr2e.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES632A.tmp" "c:\Users\Admin\AppData\Local\Temp\tgisnr2e\CSC1822EB91123E4D4FAAC923042A5EE3.TMP"
      4⤵
      PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES601C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES601C.tmp
Size 1KB
SHA256 86560717ff6c28fff6a7282913df939d4f50c3ab4f2e94dd16f9c11d27d2ab13
MD5 c4f9dde0a0f88fe9cd41ace480263ec9
SHA1 e9f88bd16877ce8806da1ea823d08c7420d9bc8a
SHA512 b30e9f8ece5f6050c4998d2170b73e59ace3699240d1e3ce09d31b9631c3ca55e5911b288e2c216001b1bcdc4180db15ea7f4a95f8e2d2c5ba4e2ca5a5a83726
TLSH
T1E221EB0547ED4B0EF0B35731AAF6172FA224FD64EFA263AB8584422C1C51104EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES632A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES632A.tmp
Size 1KB
SHA256 628a36d33e60f5eb547c1a703cf6b50c712a3d6d52db190f0ea1f11f22644242
MD5 a20db84f701ab453678250d33372c3ba
SHA1 01cac8247d582bce4d384c61a58e9a7935bf938e
SHA512 8cdc0ed7e258791cd237897b7b6ccbb59093ea517cd7b211eb06321c24644ebeb321dabde252c4cf243419ac0557eb3dac778d71027757ff811ed306de77bce2
TLSH
T16421AF0593E94B1FF077573169F6072FA274FD94EFB1935B8580422C1C61104EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3qfgoee3.jo2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qfgoee3.jo2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tgisnr2e.dll

Path C:\Users\Admin\AppData\Local\Temp\tgisnr2e\tgisnr2e.dll
Size 3KB
SHA256 9ef2e772ad5f7465a30e5921d4f659d591317e1246331456cd85a3dc1159211f
MD5 56ef4b79808d4104c1c26155096ea109
SHA1 bd5cc5eb05411c9db0857d46b659745e721f22be
SHA512 8b15d47e9a09ca00111e7c18016c57ead946babd53a9417deb623d0c1d8eaece82cd4af99912d7e3a24bf822d3e8dc601b1e6fd1fd9265435c28f96f88cf3164
TLSH
T1A671FF1A93E8465BF4B64B34AEF3430267B0F8505E72973D0880521DAC717A84E30BB1
MD5 SHA1 SHA512 TLSH

Submit Download

xzjgk42f.dll

Path C:\Users\Admin\AppData\Local\Temp\xzjgk42f\xzjgk42f.dll
Size 3KB
SHA256 00b49ef1d879d1c287509583063f2f21269ce7aff235a96970594839f7d714d1
MD5 30dd5d810117b31ce2d103c23e0e0532
SHA1 ee597e2f72c5673d4a2273787d98db2e7c13af12
SHA512 3f533444a4c8b06dd65e05f0442cf0f43f83196328f2e266d22ee66eee40453f2a27f88d96bfd706ad79ae5cf69b41e1205ede0367a957fd65b65660e76ba6cd
TLSH
T19351E11A67E8496BF4B747306EE7071627B4FC204F73536E49C043296C617985A72FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1822EB91123E4D4FAAC923042A5EE3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tgisnr2e\CSC1822EB91123E4D4FAAC923042A5EE3.TMP
Size 652B
SHA256 e04349a2888f1c2e050257327fbd7f59d2b979bcf57edc829d47fded3d857452
MD5 5fec4edb0b3815d00eb9119188f2bace
SHA1 f9a72c4f82a963d725c266cd691d6624bce43722
SHA512 2afead9aaa511e2aaf4455b667eccf0330fad587c69d96ddd39e4ff9fa246969738d2f78af3b5ddca731e71b1fe96c2c3d7621788701be8231237135575d0ced
TLSH
T158F03A0963F8420EF0F34B30B9F6436395A8FC65DE3293ED1480435D6C746149A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tgisnr2e.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tgisnr2e\tgisnr2e.0.cs
Size 631B
SHA256 89592848e6e89737ed0e8b4c35254893ced42a4722cf6677ebfdb492cc0fe32d
MD5 fdf823536375eb76cee45ee3c68e4064
SHA1 3043eb917da468be6be60a682fa94352c5f28381
SHA512 8dd9b162af9abe26660ef8723c3b46375788786424affa283cc28aad877c545479748e9c734afe6c0f3d3ae6c6c2e5ce9b0c1fd573d19c098592b0048d03e17f
TLSH
T17FF028282B9197112463C53E98EAD05DF203803352FF2D04B9EC46718F4A51EE032F2F
MD5 SHA1 SHA512 TLSH

Submit Download

tgisnr2e.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tgisnr2e\tgisnr2e.cmdline
Size 369B
SHA256 b766349a4825c591fadef9e58a320b874abee568472a8c5a25f234c8dd220cab
MD5 311d6ca9e81dcdeb47d9d1194b69684e
SHA1 864d6989d6c1da43d95964fc6e4f13a4aeafa38b
SHA512 25bd525dcef5baf44af71d49c5bb7bfe9ca2e03f0c56230af2a350e59d06698624194acd40f8b33ff353cccfa1c46063a3e8b4fc239fac2ad710b98e87ef7325
TLSH
T104E0C02A6287CAFF05DD300731E9C8ACC27217C329807F849040850DD03BCC227F1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC37B3F3F5570D4C548CA7EF90303EAAC5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xzjgk42f\CSC37B3F3F5570D4C548CA7EF90303EAAC5.TMP
Size 652B
SHA256 ff3db9789a8d078c8d3442272c6cb236bdee4ad738e22034cef8a0ced5ba81da
MD5 79dd859d43c3e53d7192f0c66032f6ca
SHA1 7dc957d83788c27862293f9a5cad89c426cd9ee3
SHA512 908f92c7fd2f133b37ec6edb21341bb576ecba177cb42e934904e39a8cc02b6f6df45f8ce0cc38a2e384835ae6c18e9a3963b0f218ea3f9e469806f2c4a985a5
TLSH
T12CF0B40A63F8120EF0F34B30BDF143A7A069BC60DE3253ED5494031D18205149661F71
MD5 SHA1 SHA512 TLSH

Submit Download

xzjgk42f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xzjgk42f\xzjgk42f.0.cs
Size 395B
SHA256 b69826cd2df337f1f23c49d6c651f53423debd37dab6b9d02043b8535feb97ca
MD5 1dc194389d4636babbc76a3542a983fe
SHA1 863de1bbc709cff4b0204cc0ad4b8f7456242a0c
SHA512 64632984268581092f94fb11f162d59447d8fff719d59f0548a09bc0bdc5007105c5d28b33b703f5ead36db006cbe5307ad97cfe4e0872c19d0b24e240668c50
TLSH
T1A5E0D82826D39B15305BD629AD5BD0AAF623903702FB2C01F9FC07718F0745AA235F1E
MD5 SHA1 SHA512 TLSH

Submit Download

xzjgk42f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xzjgk42f\xzjgk42f.cmdline
Size 369B
SHA256 a2d94a166903b9ee0f09536d853fc1a5728c30003df05c366380a367e8093c79
MD5 5512e11f62da5e15ce77257c720a5892
SHA1 8f8e6c7aa2d2442f377e0794923d0db59093f53d
SHA512 f3b6be7ff73449fd789d8b7fbc4e1a78a4db8514b1993656426b20eb7ef0b04482e90e226ff41be1775ec93467f1d0f36c92052c7e71ed176ad688545e2850a7
TLSH
T15BE0C02A4286C67E11DD5017236DC5ACC273474329803F8460904A1DD03F00067D1B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2080-20-0x00000264EC0F0000-0x00000264EC0FC000-memory.dmp

Download

memory/2652-38-0x000001F4B9080000-0x000001F4B908C000-memory.dmp

Download

memory/3212-44-0x0000000003180000-0x000000000318E000-memory.dmp

Download

memory/3212-41-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

Download

memory/4788-23-0x0000021789AE0000-0x0000021789AEC000-memory.dmp

Download

memory/4900-1-0x00000188D10E0000-0x00000188D10F0000-memory.dmp

Download

memory/4900-2-0x00000188D1050000-0x00000188D1072000-memory.dmp

Download

memory/4900-10-0x00000188D10E0000-0x00000188D10F0000-memory.dmp

Download

memory/4900-40-0x00000188D1200000-0x00000188D1208000-memory.dmp

Download

memory/4900-0-0x00000188D10E0000-0x00000188D10F0000-memory.dmp

Download

memory/4900-42-0x00000188D10E0000-0x00000188D10F0000-memory.dmp

Download

memory/4900-25-0x00000188D11F0000-0x00000188D11F8000-memory.dmp

Download

memory/4900-47-0x00000188B89A0000-0x00000188B89AC000-memory.dmp

Download

memory/5056-35-0x0000014534360000-0x000001453436C000-memory.dmp

Download