donutloader | da5b5fd0d39a418c3c3827bfaf3fc639d4f1998eb81cc573a700770e957e1842

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sewi.-cleaned.exe
Size 2.1MB
Sample260511-vps16aay4p
SHA256 da5b5fd0d39a418c3c3827bfaf3fc639d4f1998eb81cc573a700770e957e1842
MD5 8416003064c9c8e95950b29676178e8c
SHA1 23dce3392103f3599ab29accda1fca4295c3a212
SHA512 ce8376b1124c45bc8413a5c12ea7e489501e46e17bd511cfea4389d856c1d12ebb76cc868d1ac9b0e6cf956f5eea1f6c7663c63019f6005216de96e9dc8ff91d
SSDEEP 49152:Um0i06M0sXfailWljibB+vvUps5BG1RKMgZwHMmCcehp:U8ld/ilWljq+kpszRZwsmCB
TLSH
T182A533156760C381EFA441F93677F255E33E60BCA32BE1EC184BF26FB5A47880A15672
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

82.22.62.240:121
82.26.74.177:121

Mutex

1W5BQTCWSrZ34GpC

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3704-44-0x000001A2621E0000-0x000001A2621EE000-memory.dmp	family_xworm
behavioral2/memory/3704-45-0x000001A2621F0000-0x000001A2621FE000-memory.dmp	family_xworm

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/3704-38-0x000001A248F50000-0x000001A248F61000-memory.dmp	family_donutloader
behavioral2/memory/3704-41-0x000001A248F70000-0x000001A248F81000-memory.dmp	family_donutloader

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Nesm 1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	oda 1.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NalDrv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\NalDrv.sys"	sDQ0X.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	RuntimeBroker.exe

Executes dropped EXE 4 IoCs

pid	Process
1456	Sewi.exe
2028	Nesm 1.exe
4448	oda 1.exe
3896	sDQ0X.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\Download\hOogK.sys	Sewi.exe
File created	C:\Windows\SoftwareDistribution\Download\sDQ0X.exe	Sewi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sewi.-cleaned.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4448	oda 1.exe
4448	oda 1.exe
4448	oda 1.exe
2028	Nesm 1.exe
2028	Nesm 1.exe
2028	Nesm 1.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3896	sDQ0X.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	oda 1.exe
Token: SeDebugPrivilege	2028	Nesm 1.exe
Token: SeDebugPrivilege	3704	RuntimeBroker.exe
Token: SeDebugPrivilege	3704	RuntimeBroker.exe
Token: SeSystemEnvironmentPrivilege	3896	sDQ0X.exe
Token: SeDebugPrivilege	3896	sDQ0X.exe
Token: SeLoadDriverPrivilege	3896	sDQ0X.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1456	5048	Sewi.-cleaned.exe	79
PID 5048 wrote to memory of 2028	5048	Sewi.-cleaned.exe	81
PID 5048 wrote to memory of 4448	5048	Sewi.-cleaned.exe	82
PID 4448 wrote to memory of 3704	4448	oda 1.exe	59
PID 2028 wrote to memory of 3704	2028	Nesm 1.exe	59
PID 1456 wrote to memory of 3896	1456	Sewi.exe	83

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Users\Admin\AppData\Local\Temp\Sewi.-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\Sewi.-cleaned.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\Sewi.exe
  "C:\Users\Admin\AppData\Local\Temp\Sewi.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SoftwareDistribution\Download\sDQ0X.exe
    "C:\Windows\SoftwareDistribution\Download\sDQ0X.exe" -map C:\Windows\SoftwareDistribution\Download\hOogK.sys
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
- C:\Users\Admin\AppData\Local\Temp\Nesm 1.exe
  "C:\Users\Admin\AppData\Local\Temp\Nesm 1.exe"
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\oda 1.exe
  "C:\Users\Admin\AppData\Local\Temp\oda 1.exe"
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nesm 1.exe

Path C:\Users\Admin\AppData\Local\Temp\Nesm 1.exe
Size 72KB
SHA256 e4a163c1d0757a95b028b813430e80f961718181dd7bbaf65fb467784ca24fad
MD5 9ea86d0e7a21831d800cbc4af500c84d
SHA1 11a231826bed8f44879f732931b086c89ae2d73e
SHA512 58dbc6f89c12e201834db05dbbbf27bad0c00f05764bbd0dc79ad574ee12e0d2aeceef4b03179a5e45effa985a8781edc110a1fe126a1bd7004dee2abb568757
SSDEEP 1536:tpbWEGMAyP0TY3ba94I+qtpjfBN8u8VLcX9shJAlQV:/NGtAI2mXj5+9ImAl0
TLSH
T1DD73D0B9154B3015DE92073D8A7206C22AE8ED9DD36BA2F877E6217649F7703063B374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sewi.exe

Path C:\Users\Admin\AppData\Local\Temp\Sewi.exe
Size 2.1MB
SHA256 29bdf43af7fce4a48a4699f01ba35a9d23ec72109f9a8d59b84788610066b715
MD5 2ca19d0f12d1f16f6d08b34c48593826
SHA1 eb8a5beea1177a71a2123d666638233da57146ad
SHA512 d9217fd4f397f1a0a81447332f563ece283db881e693034135524937775b7fbb75f97bde586d12f29b3841c4d9811d1b36d64c266fcf08983e2ea83c63d5adbd
SSDEEP 49152:MKJhzckSniODlvlLyE/r9NCbm1M7nvUoJC+O93+x:M2zckSniCRCbm1MVCru
TLSH
T1A1A59D0172E945B8C22AC179C8039767CB61784E173913FB279899D1BFB13E45ABC7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oda 1.exe

Path C:\Users\Admin\AppData\Local\Temp\oda 1.exe
Size 72KB
SHA256 b877d0a4371ab8d80ba73cd10bda202231cf59636c62c28bd708e5eba82d862e
MD5 3506785f961abe7e90adb7af1e91647b
SHA1 e70e7cfc557c4df8c76a29ae1b34b79574a7bd8e
SHA512 3a9e5bd401e6b002ad265588e78011db06ea0ac7bfeddea502ca5a79318559d005ea1d73d91a0b5c085d83cbfea6bd98aa65847e6e63cf28c7d12eadfe36143f
SSDEEP 1536:0jvM5f0rOMQJJm7jaAPreihCvEFMu4+k1cMyAIB7:aY0iMQk5BCSi1cMv6
TLSH
T16C73DFFA424C818BC8B752F18C016722197DD8746D86E2DA2E5602A8B649F74EF74FF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Roaming\XWormClient.exe
Size 129KB
SHA256 032233b9effcaf9a5446687ff76885ce2f69c89a277fd3bef36c3abe763f29e9
MD5 b2050c10311377b83b278e9514d7fdfa
SHA1 34f7fd750777dd86485e9fca0ee6e7b648036ceb
SHA512 df9481dfb45790d84f7ef868334c30be33c1887b60439c77f30efaad28dfd8414cc08a87a85c33809718bc69749cabe0e65efbb173f48cec82c8a451eb68ec9f
SSDEEP 1536:157mJ2Oj4oFbSQCYwh0aw0ckaWO22u3E53NLyX7Winj3fGdddQhddd2ddsRyP/M6:1ZhOjJo0awXk6+EviTfu/MdSCe2W/9
TLSH
T1AFD37C6A66E820D8D13B527CC5C28306F771B429170157DF02E0C1BA1F67BE9AE3AF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sDQ0X.exe

Path C:\Windows\SoftwareDistribution\Download\sDQ0X.exe
Size 260KB
SHA256 03aefd40698cafbd48138784f362fb9a36f726fb50f262ca40695729f7b553ca
MD5 083c6c05ac5875d0b6e997e894ca07bc
SHA1 69d0116998e8a70db5852fccb86d45975ce88a9a
SHA512 fb0b9994f9ddadd825476ed19a8299ef90536dae58b4f3087145ca4033a63d4ae0da944ac8bf4e71324e1b63af755ab1d82019e55de6377b00c9812ed57f3fdf
SSDEEP 3072:EAhPo1O3uPxn1aN+NYzoJb61Xe+VUNQRHcpfqbqM8TwxAwcvTQ5pP3YNoNBWPWw4:xhPZEncAOEJb/WyIxAwt5pfYNoNoS
TLSH
T1A544AD5773A430F9E463C134C8928616E7B3BC3607658B6F1394767A5F33291AE2EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2028-35-0x0000000000FE0000-0x0000000000FF8000-memory.dmp

Download

memory/3704-38-0x000001A248F50000-0x000001A248F61000-memory.dmp

Download

memory/3704-41-0x000001A248F70000-0x000001A248F81000-memory.dmp

Download

memory/3704-44-0x000001A2621E0000-0x000001A2621EE000-memory.dmp

Download

memory/3704-45-0x000001A2621F0000-0x000001A2621FE000-memory.dmp

Download

memory/3896-59-0x00000233CEBD0000-0x00000233CEBDC000-memory.dmp

Download

memory/4448-36-0x0000000000C90000-0x0000000000CA8000-memory.dmp

Download

memory/5048-37-0x00000000013A0000-0x000000000147F000-memory.dmp

Download

memory/5048-0-0x0000000000610000-0x0000000000836000-memory.dmp

Download

memory/5048-2-0x00000000055A0000-0x00000000055B0000-memory.dmp

Download

memory/5048-1-0x0000000005410000-0x00000000054AC000-memory.dmp

Download