donutloader | d9f5c44529fdcdad4d2f7dee12fa18949d4efa088efcfab9f040c5d36085bef5

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Intel.pc.exe
Size 18.3MB
Sample260509-av9wmsgw8w
SHA256 d9f5c44529fdcdad4d2f7dee12fa18949d4efa088efcfab9f040c5d36085bef5
MD5 d671a83a51bc6fa2079b96fbb260ac8e
SHA1 631ffa0a2b9be068b5b53b265357d409506834c6
SHA512 45297b5daef7f9ef1b21e90e2d9d2a52be2b90e2d5866168c40fd9399d04f127973cf335f96027379859e71729bab208350492ced71eb72dc323104b632c16b8
SSDEEP 393216:Q6LyHX9UA+LwtMXLYlrFL4sdsNez/kUzYv5sHZUcZ5O/rQFTeFQN4uO+kp4:Q6CUFLmMsVFD4O/jzYv5s5U+O/r9FQNX
TLSH
T1C917331094FF8656D6A2AD3E4695E4C10DADD0F325952BECE432B9681608F0F7BFDA03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader loader ransomware

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2892-0-0x0000000003190000-0x00000000043DE000-memory.dmp	family_donutloader

Clears Windows event logs 1 TTPs 30 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5264	wevtutil.exe
4212	wevtutil.exe
2280	wevtutil.exe
1068	wevtutil.exe
2596	wevtutil.exe
5372	wevtutil.exe
2128	wevtutil.exe
2276	wevtutil.exe
2144	wevtutil.exe
1624	wevtutil.exe
1532	wevtutil.exe
2180	wevtutil.exe
4916	wevtutil.exe
4336	wevtutil.exe
3664	wevtutil.exe
4744	wevtutil.exe
2092	wevtutil.exe
5956	wevtutil.exe
4352	wevtutil.exe
2168	wevtutil.exe
3796	wevtutil.exe
1676	wevtutil.exe
2036	wevtutil.exe
2800	wevtutil.exe
1296	wevtutil.exe
3504	wevtutil.exe
5220	wevtutil.exe
3116	wevtutil.exe
4512	wevtutil.exe
4908	wevtutil.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Intel.pc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Intel.pc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Intel.pc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2800	wevtutil.exe
Token: SeBackupPrivilege	2800	wevtutil.exe
Token: SeSecurityPrivilege	1296	wevtutil.exe
Token: SeBackupPrivilege	1296	wevtutil.exe
Token: SeSecurityPrivilege	2144	wevtutil.exe
Token: SeBackupPrivilege	2144	wevtutil.exe
Token: SeSecurityPrivilege	1624	wevtutil.exe
Token: SeBackupPrivilege	1624	wevtutil.exe
Token: SeSecurityPrivilege	1532	wevtutil.exe
Token: SeBackupPrivilege	1532	wevtutil.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	4512	wevtutil.exe
Token: SeBackupPrivilege	4512	wevtutil.exe
Token: SeSecurityPrivilege	5220	wevtutil.exe
Token: SeBackupPrivilege	5220	wevtutil.exe
Token: SeSecurityPrivilege	4744	wevtutil.exe
Token: SeBackupPrivilege	4744	wevtutil.exe
Token: SeSecurityPrivilege	5372	wevtutil.exe
Token: SeBackupPrivilege	5372	wevtutil.exe
Token: SeSecurityPrivilege	2092	wevtutil.exe
Token: SeBackupPrivilege	2092	wevtutil.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2892	Intel.pc.exe
Token: SeBackupPrivilege	2892	Intel.pc.exe
Token: SeSecurityPrivilege	2280	wevtutil.exe
Token: SeBackupPrivilege	2280	wevtutil.exe
Token: SeSecurityPrivilege	2180	wevtutil.exe
Token: SeBackupPrivilege	2180	wevtutil.exe
Token: SeSecurityPrivilege	5264	wevtutil.exe
Token: SeBackupPrivilege	5264	wevtutil.exe
Token: SeSecurityPrivilege	5956	wevtutil.exe
Token: SeBackupPrivilege	5956	wevtutil.exe
Token: SeSecurityPrivilege	4352	wevtutil.exe
Token: SeBackupPrivilege	4352	wevtutil.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2800	2892	Intel.pc.exe	79
PID 2892 wrote to memory of 1296	2892	Intel.pc.exe	81
PID 2892 wrote to memory of 2144	2892	Intel.pc.exe	83
PID 2892 wrote to memory of 1624	2892	Intel.pc.exe	85
PID 2892 wrote to memory of 1532	2892	Intel.pc.exe	87
PID 2892 wrote to memory of 4512	2892	Intel.pc.exe	89
PID 2892 wrote to memory of 5220	2892	Intel.pc.exe	91
PID 2892 wrote to memory of 4744	2892	Intel.pc.exe	93
PID 2892 wrote to memory of 5372	2892	Intel.pc.exe	95
PID 2892 wrote to memory of 2092	2892	Intel.pc.exe	97
PID 2892 wrote to memory of 2280	2892	Intel.pc.exe	99
PID 2892 wrote to memory of 2180	2892	Intel.pc.exe	101
PID 2892 wrote to memory of 5264	2892	Intel.pc.exe	103
PID 2892 wrote to memory of 5956	2892	Intel.pc.exe	105
PID 2892 wrote to memory of 4352	2892	Intel.pc.exe	107
PID 2892 wrote to memory of 4908	2892	Intel.pc.exe	109
PID 2892 wrote to memory of 4212	2892	Intel.pc.exe	111
PID 2892 wrote to memory of 2168	2892	Intel.pc.exe	113
PID 2892 wrote to memory of 1068	2892	Intel.pc.exe	115
PID 2892 wrote to memory of 2596	2892	Intel.pc.exe	117
PID 2892 wrote to memory of 2128	2892	Intel.pc.exe	119
PID 2892 wrote to memory of 4916	2892	Intel.pc.exe	121
PID 2892 wrote to memory of 4336	2892	Intel.pc.exe	123
PID 2892 wrote to memory of 3796	2892	Intel.pc.exe	125
PID 2892 wrote to memory of 3504	2892	Intel.pc.exe	127
PID 2892 wrote to memory of 3116	2892	Intel.pc.exe	129
PID 2892 wrote to memory of 1676	2892	Intel.pc.exe	131
PID 2892 wrote to memory of 2276	2892	Intel.pc.exe	133
PID 2892 wrote to memory of 3664	2892	Intel.pc.exe	135
PID 2892 wrote to memory of 2036	2892	Intel.pc.exe	137

C:\Users\Admin\AppData\Local\Temp\Intel.pc.exe
"C:\Users\Admin\AppData\Local\Temp\Intel.pc.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5220
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5264
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5956
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  PID:4908
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:4212
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:2168
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:1068
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  PID:2596
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  PID:2128
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:4916
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:4336
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:3796
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  PID:3504
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Sysmon/Operational"
  2⤵
  - Clears Windows event logs
  PID:3116
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:1676
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:2276
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:3664
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil" cl "System"
  2⤵
  - Clears Windows event logs
  PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-0-0x0000000003190000-0x00000000043DE000-memory.dmp

Download

memory/2892-1-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-2-0x000000001F660000-0x00000000208AE000-memory.dmp

Download

memory/2892-3-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-4-0x000000001E410000-0x000000001E598000-memory.dmp

Download

memory/2892-8-0x0000000001740000-0x0000000001840000-memory.dmp

Download

memory/2892-9-0x000000001EA60000-0x000000001EC7C000-memory.dmp

Download

memory/2892-12-0x000000001E8B0000-0x000000001E8C2000-memory.dmp

Download

memory/2892-13-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-14-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-15-0x00000000057B0000-0x00000000057BC000-memory.dmp

Download

memory/2892-16-0x00007FFA2DCF0000-0x00007FFA2DE3F000-memory.dmp

Download

memory/2892-17-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-18-0x0000000001740000-0x0000000001840000-memory.dmp

Download

memory/2892-19-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-20-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-37-0x0000000029130000-0x0000000029152000-memory.dmp

Download

memory/2892-38-0x00000000292A0000-0x00000000292DC000-memory.dmp

Download

memory/2892-44-0x00007FFA2DCF0000-0x00007FFA2DE3F000-memory.dmp

Download

memory/2892-46-0x0000000029880000-0x0000000029892000-memory.dmp

Download

memory/2892-45-0x0000000028BA0000-0x0000000028C4F000-memory.dmp

Download

memory/2892-47-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-48-0x000000001E400000-0x000000001E410000-memory.dmp

Download

memory/2892-50-0x00007FFA2DCF0000-0x00007FFA2DE3F000-memory.dmp

Download

memory/2892-55-0x00007FFA2DCF0000-0x00007FFA2DE3F000-memory.dmp

Download

memory/2892-71-0x00007FFA2DCF0000-0x00007FFA2DE3F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads