donutloader | c95cbde260b1680ded5b38ad8dec3784d6537ad66c325a885c10243fa9d6242e

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe
Size 683KB
Sample260502-3s7bysht4y
SHA256 c95cbde260b1680ded5b38ad8dec3784d6537ad66c325a885c10243fa9d6242e
MD5 8d4a0644aa75231e82afeb7c8617ac11
SHA1 d0ff43a16cba9c27da3d4484e6cbe5f179ad28bd
SHA512 03d6f93494937fa4916411ac8ed275cff1050a8ce097cacd5f971e940ebd09bd97ec43e37fd7906b7bffa751b33efbbf456f8833063b1c72046f533a71148d6b
SSDEEP 12288:2ObtkIFT7UCgpO9on7pmh1d5ZQaCNjJjvc+e1iqVsFPyemer5+nZoyY:jkMIrO6Fmd5ZQaUNnEiqmFcE
TLSH
T18EE4F10E7A69A8E7D9725E305C748691673278D37E505BA76CC0131E8C3B2B88F66F24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/3476-0-0x0000000000860000-0x00000000008E6000-memory.dmp	family_donutloader
behavioral2/memory/5356-12-0x0000000000B00000-0x0000000000B86000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
5356	oflit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oflit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 5356	3476	2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe	79
PID 3476 wrote to memory of 620	3476	2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_8d4a0644aa75231e82afeb7c8617ac11_cobalt-strike_elex_icedid_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Users\Admin\AppData\Local\Temp\oflit.exe
  "C:\Users\Admin\AppData\Local\Temp\oflit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sannuy.bat

Path C:\Users\Admin\AppData\Local\Temp\_sannuy.bat
Size 362B
SHA256 bfc724a75f39546716ac4dac34163c64ff0c08418338ad818454e84658a7b4b4
MD5 16a431f50f65ae20ce2d77f3e99710bd
SHA1 30c9dbaa583e0b33ff6ce01726761bc3d001da9a
SHA512 58a7fec0bd6a574bd3dafd05cc1b0fd32139aa60caf0659cad5e8afd2dc0f2d596bc9d57b48979bb57e5cf36c1cd15c45b2a10c670b44d4c3bd35735484d8988
TLSH
T16AE0DF0145AEEE6A000D606747FB5A8C8476AC5C3F0A3742E729CA2823C541CB5E2346
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ad5134a98ee5099024c46b05e340a5aaa589deca46302dfb2ab4ee191ac98bdb
MD5 323da7e7b4e270caddb85233aaf2dffc
SHA1 bea8638c9c2e62faa17548cb4343c5342bfa28c9
SHA512 a9eb4a754329d2a85867c67fae0bd6a62a55a9bcff87177ea8ad78d24c05b607ea64ff241a283f276a5b4505f1576140c9ff8966f50a60ca835a4d636564ef15
TLSH
T12FF09BEA1061B4467213F511D3C867595FA75DCE26C34D8C0005F3314C759EC8689167
MD5 SHA1 SHA512 TLSH

Submit Download

oflit.exe

Path C:\Users\Admin\AppData\Local\Temp\oflit.exe
Size 683KB
SHA256 4ca4a63ca9ac4edf3718ec9d92115106fcdc5bf085a123be84d9ea33e419a459
MD5 100e0aed1cfb06c92b8c6d49e7448473
SHA1 3d9a07f67742b33d6e2c1637a11c2ca5e4f11cd9
SHA512 32de4e65dc8062c032c83e0f80c976d761f5cd2b8907d68851cd2696d87c47bf59dbb46a974c1528b833e16435d535882e70b96f09c6d5cc75b7f7286942d2db
SSDEEP 12288:2ObtkIFT7UCgpO9on7pmh1d5ZQaCNjJjvc+e1iqVsFPyemer5+nZoyl:jkMIrO6Fmd5ZQaUNnEiqmFcB
TLSH
T1C3E4F10E7A69A8E7D9725E305C748691673278D37E505BA76CC0131E8C3B2B88F66F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3476-0-0x0000000000860000-0x00000000008E6000-memory.dmp

Download

memory/5356-12-0x0000000000B00000-0x0000000000B86000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads