donutloader | da5b5fd0d39a418c3c3827bfaf3fc639d4f1998eb81cc573a700770e957e1842

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sewi.-cleaned.exe
Size 2.1MB
Sample260511-vps16aay4p
SHA256 da5b5fd0d39a418c3c3827bfaf3fc639d4f1998eb81cc573a700770e957e1842
MD5 8416003064c9c8e95950b29676178e8c
SHA1 23dce3392103f3599ab29accda1fca4295c3a212
SHA512 ce8376b1124c45bc8413a5c12ea7e489501e46e17bd511cfea4389d856c1d12ebb76cc868d1ac9b0e6cf956f5eea1f6c7663c63019f6005216de96e9dc8ff91d
SSDEEP 49152:Um0i06M0sXfailWljibB+vvUps5BG1RKMgZwHMmCcehp:U8ld/ilWljq+kpszRZwsmCB
TLSH
T182A533156760C381EFA441F93677F255E33E60BCA32BE1EC184BF26FB5A47880A15672
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

82.26.74.177:121
82.22.62.240:121

Mutex

2DS1HLsy2oo3G09H

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/3756-45-0x000001B3BD660000-0x000001B3BD66E000-memory.dmp	family_xworm
behavioral1/memory/3756-46-0x000001B3BD650000-0x000001B3BD65E000-memory.dmp	family_xworm

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral1/memory/3756-39-0x000001B3BD1C0000-0x000001B3BD1D1000-memory.dmp	family_donutloader
behavioral1/memory/3756-37-0x000001B3BD1A0000-0x000001B3BD1B1000-memory.dmp	family_donutloader

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	oda 1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Nesm 1.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NalDrv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\NalDrv.sys"	sDQ0X.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	Sewi.-cleaned.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	Sewi.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	RuntimeBroker.exe

Executes dropped EXE 4 IoCs

pid	Process
5140	Sewi.exe
2172	Nesm 1.exe
6108	oda 1.exe
5304	sDQ0X.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\Download\hOogK.sys	Sewi.exe
File created	C:\Windows\SoftwareDistribution\Download\sDQ0X.exe	Sewi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sewi.-cleaned.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2172	Nesm 1.exe
6108	oda 1.exe
2172	Nesm 1.exe
2172	Nesm 1.exe
6108	oda 1.exe
6108	oda 1.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5304	sDQ0X.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	Nesm 1.exe
Token: SeDebugPrivilege	6108	oda 1.exe
Token: SeDebugPrivilege	3756	RuntimeBroker.exe
Token: SeDebugPrivilege	3756	RuntimeBroker.exe
Token: SeSystemEnvironmentPrivilege	5304	sDQ0X.exe
Token: SeDebugPrivilege	5304	sDQ0X.exe
Token: SeLoadDriverPrivilege	5304	sDQ0X.exe
Token: SeShutdownPrivilege	3756	RuntimeBroker.exe
Token: SeShutdownPrivilege	3756	RuntimeBroker.exe
Token: SeShutdownPrivilege	3756	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 5140	2328	Sewi.-cleaned.exe	84
PID 2328 wrote to memory of 2172	2328	Sewi.-cleaned.exe	86
PID 2328 wrote to memory of 6108	2328	Sewi.-cleaned.exe	87
PID 2172 wrote to memory of 3756	2172	Nesm 1.exe	60
PID 6108 wrote to memory of 3756	6108	oda 1.exe	60
PID 5140 wrote to memory of 5304	5140	Sewi.exe	88

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Users\Admin\AppData\Local\Temp\Sewi.-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\Sewi.-cleaned.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\Sewi.exe
  "C:\Users\Admin\AppData\Local\Temp\Sewi.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\SoftwareDistribution\Download\sDQ0X.exe
    "C:\Windows\SoftwareDistribution\Download\sDQ0X.exe" -map C:\Windows\SoftwareDistribution\Download\hOogK.sys
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- C:\Users\Admin\AppData\Local\Temp\Nesm 1.exe
  "C:\Users\Admin\AppData\Local\Temp\Nesm 1.exe"
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2172
- C:\Users\Admin\AppData\Local\Temp\oda 1.exe
  "C:\Users\Admin\AppData\Local\Temp\oda 1.exe"
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nesm 1.exe

Path C:\Users\Admin\AppData\Local\Temp\Nesm 1.exe
Size 72KB
SHA256 e4a163c1d0757a95b028b813430e80f961718181dd7bbaf65fb467784ca24fad
MD5 9ea86d0e7a21831d800cbc4af500c84d
SHA1 11a231826bed8f44879f732931b086c89ae2d73e
SHA512 58dbc6f89c12e201834db05dbbbf27bad0c00f05764bbd0dc79ad574ee12e0d2aeceef4b03179a5e45effa985a8781edc110a1fe126a1bd7004dee2abb568757
SSDEEP 1536:tpbWEGMAyP0TY3ba94I+qtpjfBN8u8VLcX9shJAlQV:/NGtAI2mXj5+9ImAl0
TLSH
T1DD73D0B9154B3015DE92073D8A7206C22AE8ED9DD36BA2F877E6217649F7703063B374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sewi.exe

Path C:\Users\Admin\AppData\Local\Temp\Sewi.exe
Size 2.1MB
SHA256 29bdf43af7fce4a48a4699f01ba35a9d23ec72109f9a8d59b84788610066b715
MD5 2ca19d0f12d1f16f6d08b34c48593826
SHA1 eb8a5beea1177a71a2123d666638233da57146ad
SHA512 d9217fd4f397f1a0a81447332f563ece283db881e693034135524937775b7fbb75f97bde586d12f29b3841c4d9811d1b36d64c266fcf08983e2ea83c63d5adbd
SSDEEP 49152:MKJhzckSniODlvlLyE/r9NCbm1M7nvUoJC+O93+x:M2zckSniCRCbm1MVCru
TLSH
T1A1A59D0172E945B8C22AC179C8039767CB61784E173913FB279899D1BFB13E45ABC7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oda 1.exe

Path C:\Users\Admin\AppData\Local\Temp\oda 1.exe
Size 72KB
SHA256 b877d0a4371ab8d80ba73cd10bda202231cf59636c62c28bd708e5eba82d862e
MD5 3506785f961abe7e90adb7af1e91647b
SHA1 e70e7cfc557c4df8c76a29ae1b34b79574a7bd8e
SHA512 3a9e5bd401e6b002ad265588e78011db06ea0ac7bfeddea502ca5a79318559d005ea1d73d91a0b5c085d83cbfea6bd98aa65847e6e63cf28c7d12eadfe36143f
SSDEEP 1536:0jvM5f0rOMQJJm7jaAPreihCvEFMu4+k1cMyAIB7:aY0iMQk5BCSi1cMv6
TLSH
T16C73DFFA424C818BC8B752F18C016722197DD8746D86E2DA2E5602A8B649F74EF74FF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Roaming\XWormClient.exe
Size 100KB
SHA256 e86870769ee6c797e09457bd99c58d9bf2303cf0193a24ef9b1222c2c3daf628
MD5 ba4cfe6461afa1004c52f19c8f2169dc
SHA1 ab8539ef6b2a93ff9589dec4b34a0257b6296c92
SHA512 2c5190d7609767237311260f241c619b82434ca640f396bb9710d356286844f82f320f9e05525a38707f2a52977790c0c3e2a217b36a7f0095a87c138b939af0
SSDEEP 1536:l5gC0wSKok6UAeVEBFgvozLmwCedFpQHI8PXjYlTx/2whBGE/5K5/EJD2VEUcO8h:sC+vEArBCgmejo8X/2whRJDAE2r+e
TLSH
T109A37C6A22EC30D9E17B52BDC2C24206E3B1B431135257EF06A0C17E1F67BD56E3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDQ0X.exe

Path C:\Windows\SoftwareDistribution\Download\sDQ0X.exe
Size 260KB
SHA256 03aefd40698cafbd48138784f362fb9a36f726fb50f262ca40695729f7b553ca
MD5 083c6c05ac5875d0b6e997e894ca07bc
SHA1 69d0116998e8a70db5852fccb86d45975ce88a9a
SHA512 fb0b9994f9ddadd825476ed19a8299ef90536dae58b4f3087145ca4033a63d4ae0da944ac8bf4e71324e1b63af755ab1d82019e55de6377b00c9812ed57f3fdf
SSDEEP 3072:EAhPo1O3uPxn1aN+NYzoJb61Xe+VUNQRHcpfqbqM8TwxAwcvTQ5pP3YNoNBWPWw4:xhPZEncAOEJb/WyIxAwt5pfYNoNoS
TLSH
T1A544AD5773A430F9E463C134C8928616E7B3BC3607658B6F1394767A5F33291AE2EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2172-30-0x0000000000950000-0x0000000000968000-memory.dmp

Download

memory/2172-43-0x000000001B410000-0x000000001B420000-memory.dmp

Download

memory/2328-0-0x0000000000E90000-0x00000000010B6000-memory.dmp

Download

memory/2328-1-0x0000000005AB0000-0x0000000005B4C000-memory.dmp

Download

memory/2328-2-0x0000000005C30000-0x0000000005C40000-memory.dmp

Download

memory/3756-45-0x000001B3BD660000-0x000001B3BD66E000-memory.dmp

Download

memory/3756-37-0x000001B3BD1A0000-0x000001B3BD1B1000-memory.dmp

Download

memory/3756-39-0x000001B3BD1C0000-0x000001B3BD1D1000-memory.dmp

Download

memory/3756-46-0x000001B3BD650000-0x000001B3BD65E000-memory.dmp

Download

memory/6108-44-0x000000001AF50000-0x000000001AF60000-memory.dmp

Download

memory/6108-35-0x0000000000290000-0x00000000002A8000-memory.dmp

Download