donutloader | 82206305d16d575a8eb710056c3779a69ab381390633f0c16db5684d4a692f74

General

Target
2026-05-22_5416ca559411cc46f66a4c4542552fa0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 8.3MB
Sample260522-dd9fbscz2p
SHA256 82206305d16d575a8eb710056c3779a69ab381390633f0c16db5684d4a692f74
MD5 5416ca559411cc46f66a4c4542552fa0
SHA1 ffbf44e2ee33d029fe8d04e3d22580ab37be5a5e
SHA512 f1672da6c4daf86593451a740ece0555e36199994d2a7670126332ac60e596a300a9fdf2fd7543c8f11c90cfd704391abd731b4d52b7f9a04ebe93b612ff4b7f
SSDEEP 98304:+ymrNIKTwMZ/8+tlk4wv7CwuOvBhdhuTSE:BcyvMOR7CN
TLSH
T13D964A17ECA595E8C0AED130CA769653BB717C491B3123D72B50F6283FB6BE0A979304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1888-9-0x000001BC1B3D0000-0x000001BC1B3D9000-memory.dmp	family_donutloader

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral1/memory/1888-12-0x000001BC1F7E0000-0x000001BC2203E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 1 IoCs

pid	Process
1888	gspawn.exe

Loads dropped DLL 1 IoCs

pid	Process
1888	gspawn.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Logs\\gspawn.exe"	2026-05-22_5416ca559411cc46f66a4c4542552fa0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	helppane.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	2026-05-22_5416ca559411cc46f66a4c4542552fa0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Token: SeShutdownPrivilege	4124	2026-05-22_5416ca559411cc46f66a4c4542552fa0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Token: SeDebugPrivilege	1888	gspawn.exe
Token: SeShutdownPrivilege	1888	gspawn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3848	helppane.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3848	helppane.exe
3848	helppane.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1888	3848	helppane.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-05-22_5416ca559411cc46f66a4c4542552fa0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_5416ca559411cc46f66a4c4542552fa0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Logs\gspawn.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Logs\gspawn.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gspawn.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Logs\gspawn.exe
Size 53KB
SHA256 22f8e9390eaa17803c83a2e46e032663ef37343df8b7b2ac178dd410d15e4573
MD5 8d09d4b1ad2c41a00785f78e3f7f7562
SHA1 02bde9f07abeab8bd5d91014588a0d381636284a
SHA512 e22f8ce51d0fd3d100314871b5688c96b3957ed22c6a720eb59927917584de70e6fda13db1e34e77fda285474dfb1bac0c60f1a338ddca026f00f09c99a30294
SSDEEP 768:7vqw2RLAuDeGJiqrmehiVSrmaBP39VtT5QYiUF4pzPxWEK1U:7B7qjh3rmKPNPT5Q7UgPx2U
TLSH
T19B3319B2F104A885CA0BC9B3D86EDC31A4B23DDDD9E0465D22FE722959B33D21099D5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Logs\jli.dll
Size 147KB
SHA256 b5e659d633441238895a4d0f277dac5b06e10bdd5057ab027b6a49ca8e841e04
MD5 fa9b9c2893dedf3c1c8b6fd57d074335
SHA1 3fe9b58362f14408d40bb479d558edf7f2dff74b
SHA512 182d851f6bc8dbb8e2cbab320879b92c45dd9b1309a2625c0464947b990afe0326398b291a6f25e286c78d449ed2b1d0fb3730b791f97e40ba28a5261e834a24
SSDEEP 3072:LXxNS7iueoV/n3SnAT0WYJxiC9wNBQBZpmgFdoyJ:lg7cutTgMCrPmg8yJ
TLSH
T178E37D2BAFE19954C2B7C27598E74EAC3DB7773141D160C9829386301A12BF7BB1E52C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UID-device.log

Path C:\Users\Admin\AppData\Local\applogs\UID-device.log
Size 32B
SHA256 9e4bcfcb372052e6f358cb20d225dcd7704ce519be4f27b886b4b6222bb5120a
MD5 a1e37ebaffbaeb4bbb2c3f876bd44ce0
SHA1 27087820ce6fa69dcd7c4f80071820c69197dc92
SHA512 a280265bbe1bfcfe29601831f0b19bf6d13c51b41520e831776308dcd1e9ece5075e154b25451f8620afd38a84cebf1be23b3afdbe154084d1ca6ed93dd37b67
MD5 SHA1 SHA512

Submit Download

memory/1888-9-0x000001BC1B3D0000-0x000001BC1B3D9000-memory.dmp

Download

memory/1888-10-0x000001BC1B3F0000-0x000001BC1B3F9000-memory.dmp

Download

memory/1888-12-0x000001BC1F7E0000-0x000001BC2203E000-memory.dmp

Download

memory/1888-15-0x00007FFCA9DA0000-0x00007FFCA9DCD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads