donutloader | d9f5c44529fdcdad4d2f7dee12fa18949d4efa088efcfab9f040c5d36085bef5

Analysis

max time kernel
149s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Intel.pc.exe
Size 18.3MB
Sample260509-av9wmsgw8w
SHA256 d9f5c44529fdcdad4d2f7dee12fa18949d4efa088efcfab9f040c5d36085bef5
MD5 d671a83a51bc6fa2079b96fbb260ac8e
SHA1 631ffa0a2b9be068b5b53b265357d409506834c6
SHA512 45297b5daef7f9ef1b21e90e2d9d2a52be2b90e2d5866168c40fd9399d04f127973cf335f96027379859e71729bab208350492ced71eb72dc323104b632c16b8
SSDEEP 393216:Q6LyHX9UA+LwtMXLYlrFL4sdsNez/kUzYv5sHZUcZ5O/rQFTeFQN4uO+kp4:Q6CUFLmMsVFD4O/jzYv5s5U+O/r9FQNX
TLSH
T1C917331094FF8656D6A2AD3E4695E4C10DADD0F325952BECE432B9681608F0F7BFDA03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader loader ransomware

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/2236-0-0x0000000003290000-0x00000000044DE000-memory.dmp	family_donutloader

Clears Windows event logs 1 TTPs 30 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2740	wevtutil.exe
4188	wevtutil.exe
2248	wevtutil.exe
4772	wevtutil.exe
3840	wevtutil.exe
624	wevtutil.exe
4576	wevtutil.exe
2196	wevtutil.exe
940	wevtutil.exe
4348	wevtutil.exe
3032	wevtutil.exe
2896	wevtutil.exe
3424	wevtutil.exe
2164	wevtutil.exe
2212	wevtutil.exe
1384	wevtutil.exe
204	wevtutil.exe
1640	wevtutil.exe
3192	wevtutil.exe
2172	wevtutil.exe
3224	wevtutil.exe
2608	wevtutil.exe
632	wevtutil.exe
2880	wevtutil.exe
4820	wevtutil.exe
8	wevtutil.exe
1876	wevtutil.exe
4000	wevtutil.exe
1896	wevtutil.exe
4692	wevtutil.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Intel.pc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Intel.pc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Intel.pc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	3840	wevtutil.exe
Token: SeBackupPrivilege	3840	wevtutil.exe
Token: SeSecurityPrivilege	632	wevtutil.exe
Token: SeBackupPrivilege	632	wevtutil.exe
Token: SeSecurityPrivilege	4000	wevtutil.exe
Token: SeBackupPrivilege	4000	wevtutil.exe
Token: SeSecurityPrivilege	2740	wevtutil.exe
Token: SeBackupPrivilege	2740	wevtutil.exe
Token: SeSecurityPrivilege	2880	wevtutil.exe
Token: SeBackupPrivilege	2880	wevtutil.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	3032	wevtutil.exe
Token: SeBackupPrivilege	3032	wevtutil.exe
Token: SeSecurityPrivilege	204	wevtutil.exe
Token: SeBackupPrivilege	204	wevtutil.exe
Token: SeSecurityPrivilege	4820	wevtutil.exe
Token: SeBackupPrivilege	4820	wevtutil.exe
Token: SeSecurityPrivilege	624	wevtutil.exe
Token: SeBackupPrivilege	624	wevtutil.exe
Token: SeSecurityPrivilege	8	wevtutil.exe
Token: SeBackupPrivilege	8	wevtutil.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	2236	Intel.pc.exe
Token: SeBackupPrivilege	2236	Intel.pc.exe
Token: SeSecurityPrivilege	3224	wevtutil.exe
Token: SeBackupPrivilege	3224	wevtutil.exe
Token: SeSecurityPrivilege	1896	wevtutil.exe
Token: SeBackupPrivilege	1896	wevtutil.exe
Token: SeSecurityPrivilege	1876	wevtutil.exe
Token: SeBackupPrivilege	1876	wevtutil.exe
Token: SeSecurityPrivilege	4692	wevtutil.exe
Token: SeBackupPrivilege	4692	wevtutil.exe
Token: SeSecurityPrivilege	2896	wevtutil.exe
Token: SeBackupPrivilege	2896	wevtutil.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3840	2236	Intel.pc.exe	84
PID 2236 wrote to memory of 632	2236	Intel.pc.exe	86
PID 2236 wrote to memory of 4000	2236	Intel.pc.exe	88
PID 2236 wrote to memory of 2740	2236	Intel.pc.exe	90
PID 2236 wrote to memory of 2880	2236	Intel.pc.exe	92
PID 2236 wrote to memory of 3032	2236	Intel.pc.exe	98
PID 2236 wrote to memory of 204	2236	Intel.pc.exe	100
PID 2236 wrote to memory of 4820	2236	Intel.pc.exe	102
PID 2236 wrote to memory of 624	2236	Intel.pc.exe	105
PID 2236 wrote to memory of 8	2236	Intel.pc.exe	107
PID 2236 wrote to memory of 3224	2236	Intel.pc.exe	113
PID 2236 wrote to memory of 1896	2236	Intel.pc.exe	115
PID 2236 wrote to memory of 1876	2236	Intel.pc.exe	117
PID 2236 wrote to memory of 4692	2236	Intel.pc.exe	119
PID 2236 wrote to memory of 2896	2236	Intel.pc.exe	121
PID 2236 wrote to memory of 1640	2236	Intel.pc.exe	123
PID 2236 wrote to memory of 2248	2236	Intel.pc.exe	125
PID 2236 wrote to memory of 3424	2236	Intel.pc.exe	127
PID 2236 wrote to memory of 3192	2236	Intel.pc.exe	129
PID 2236 wrote to memory of 2164	2236	Intel.pc.exe	131
PID 2236 wrote to memory of 4188	2236	Intel.pc.exe	133
PID 2236 wrote to memory of 2212	2236	Intel.pc.exe	135
PID 2236 wrote to memory of 4576	2236	Intel.pc.exe	137
PID 2236 wrote to memory of 2196	2236	Intel.pc.exe	139
PID 2236 wrote to memory of 4772	2236	Intel.pc.exe	141
PID 2236 wrote to memory of 2172	2236	Intel.pc.exe	143
PID 2236 wrote to memory of 1384	2236	Intel.pc.exe	145
PID 2236 wrote to memory of 940	2236	Intel.pc.exe	147
PID 2236 wrote to memory of 4348	2236	Intel.pc.exe	149
PID 2236 wrote to memory of 2608	2236	Intel.pc.exe	151

C:\Users\Admin\AppData\Local\Temp\Intel.pc.exe
"C:\Users\Admin\AppData\Local\Temp\Intel.pc.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:204
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3224
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  PID:1640
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:2248
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:3424
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:3192
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  PID:2164
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  PID:4188
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:2212
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:4576
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:2196
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  PID:4772
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  PID:2172
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:1384
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:940
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4348
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000003290000-0x00000000044DE000-memory.dmp

Download

memory/2236-1-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-2-0x000000001F660000-0x00000000208AE000-memory.dmp

Download

memory/2236-4-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-3-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-5-0x000000001E400000-0x000000001E588000-memory.dmp

Download

memory/2236-9-0x00000000017E0000-0x00000000018E0000-memory.dmp

Download

memory/2236-10-0x000000001E960000-0x000000001EB7C000-memory.dmp

Download

memory/2236-13-0x0000000005940000-0x0000000005952000-memory.dmp

Download

memory/2236-14-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-16-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-15-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-17-0x0000000005730000-0x000000000573C000-memory.dmp

Download

memory/2236-18-0x00007FFB57830000-0x00007FFB5797E000-memory.dmp

Download

memory/2236-20-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-19-0x00000000017E0000-0x00000000018E0000-memory.dmp

Download

memory/2236-21-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-38-0x000000001DBC0000-0x000000001DBE2000-memory.dmp

Download

memory/2236-39-0x000000001DBF0000-0x000000001DC2C000-memory.dmp

Download

memory/2236-45-0x00007FFB57830000-0x00007FFB5797E000-memory.dmp

Download

memory/2236-46-0x000000001EE30000-0x000000001EF45000-memory.dmp

Download

memory/2236-47-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-48-0x000000001E3F0000-0x000000001E400000-memory.dmp

Download

memory/2236-50-0x00007FFB57830000-0x00007FFB5797E000-memory.dmp

Download

memory/2236-54-0x00007FFB57830000-0x00007FFB5797E000-memory.dmp

Download

memory/2236-66-0x00007FFB57830000-0x00007FFB5797E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads