donutloader | c95cbde260b1680ded5b38ad8dec3784d6537ad66c325a885c10243fa9d6242e

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe
Size 683KB
Sample260502-3s7bysht4y
SHA256 c95cbde260b1680ded5b38ad8dec3784d6537ad66c325a885c10243fa9d6242e
MD5 8d4a0644aa75231e82afeb7c8617ac11
SHA1 d0ff43a16cba9c27da3d4484e6cbe5f179ad28bd
SHA512 03d6f93494937fa4916411ac8ed275cff1050a8ce097cacd5f971e940ebd09bd97ec43e37fd7906b7bffa751b33efbbf456f8833063b1c72046f533a71148d6b
SSDEEP 12288:2ObtkIFT7UCgpO9on7pmh1d5ZQaCNjJjvc+e1iqVsFPyemer5+nZoyY:jkMIrO6Fmd5ZQaUNnEiqmFcE
TLSH
T18EE4F10E7A69A8E7D9725E305C748691673278D37E505BA76CC0131E8C3B2B88F66F24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4136-0-0x00000000006C0000-0x0000000000746000-memory.dmp	family_donutloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe

Executes dropped EXE 1 IoCs

pid	Process
3020	loloz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loloz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3020	4136	2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe	84
PID 4136 wrote to memory of 2016	4136	2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\loloz.exe
  "C:\Users\Admin\AppData\Local\Temp\loloz.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sannuy.bat

Path C:\Users\Admin\AppData\Local\Temp\_sannuy.bat
Size 362B
SHA256 bfc724a75f39546716ac4dac34163c64ff0c08418338ad818454e84658a7b4b4
MD5 16a431f50f65ae20ce2d77f3e99710bd
SHA1 30c9dbaa583e0b33ff6ce01726761bc3d001da9a
SHA512 58a7fec0bd6a574bd3dafd05cc1b0fd32139aa60caf0659cad5e8afd2dc0f2d596bc9d57b48979bb57e5cf36c1cd15c45b2a10c670b44d4c3bd35735484d8988
TLSH
T16AE0DF0145AEEE6A000D606747FB5A8C8476AC5C3F0A3742E729CA2823C541CB5E2346
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 11ed5e38801efbc5df4d89f30579688c6830d5aefc0c8bd9ef5f8ffd75242f2e
MD5 9a942d418bafabda91927517026f36ef
SHA1 bbad21bf5fba70173a737deed296780b57596331
SHA512 a16ee3650e808ad1228a0774e8176f3ecdb40334442a5974befcd9eecbe89d6adc68223b6307104f5fd0760200dceb1fbb6ce7284ff02a83370d534a15fce4db
TLSH
T1AAF09BED26E5F1663513E933D68867905B574D9815438DCC0105F2B08DB7C0CC544376
MD5 SHA1 SHA512 TLSH

Submit Download

loloz.exe

Path C:\Users\Admin\AppData\Local\Temp\loloz.exe
Size 683KB
SHA256 d3816286f3376c0c50f3db46aa8c8e79277ac2e7eeea073e58373350abd11f2c
MD5 d1bb458442c469717d0bca5ee38e0c93
SHA1 ea2fa57485d7bb0aa34f60266e43a2a3ea158e45
SHA512 ed7ecc9448ab0b5ded79712ce8bfaf07a56f8ac03e40bb6b313c72fa3894dd7ef82f56a0940dee715f053f504dfb5347526968546e6ea576240a0186b85d345b
SSDEEP 12288:2ObtkIFT7UCgpO9on7pmh1d5ZQaCNjJjvc+e1iqVsFPyemer5+nZoyQ:jkMIrO6Fmd5ZQaUNnEiqmFcE
TLSH
T1F2E4F10E7A69A8E7D9725E305C748691673378D37E505BA76CC0131E8C3B2B88F66F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4136-0-0x00000000006C0000-0x0000000000746000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads