donutloader | 5d00a8d861b0ef150cfd2cc298f4c01a1006ded8144a9b0b956fc3cb267397c2

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinRAR.exe
Size 1.9MB
Sample260524-sr2d7sg15q
SHA256 5d00a8d861b0ef150cfd2cc298f4c01a1006ded8144a9b0b956fc3cb267397c2
MD5 629c5de7eaa1475a8537f42542b11b99
SHA1 bb7cd47c9e8da54479615e087dae97a03fc9093b
SHA512 78fa88cba3d1b9fe4f80b44b9479756e2618269e7458b2b4d25b5b99d808e42e49160f607b2c3c336e4007372a87eded81735f07c983b228eefd123a1e359109
SSDEEP 49152:JgqKIXzbUQEaLpkl9sUeoS4HdGieV8emYvEVj:JzEQlLg9Q4Qig89qEJ
TLSH
T18F95120AE7E404F8E0B7A1B8DD164903E777BC9E1761D78F07A856562F232A09D3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery donutloader fatalrat valleyrat_s2 infostealer loader rat stealer trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

156.245.235.131:443
127.0.0.1:8888
127.0.0.1:80

Attributes

campaign_date
2026. 3.22

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/4168-60-0x0000000001210000-0x0000000001230000-memory.dmp	family_donutloader
behavioral2/files/0x001900000002b3f4-59.dat	family_donutloader

Fatal Rat payload 2 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/4996-68-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat
behavioral2/memory/3168-89-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat

Executes dropped EXE 6 IoCs

pid	Process
4996	NvBackend.exe
2172	QQPCTray.exe
4228	QQPCTray.exe
3168	NvBackend.exe
1824	NvBackend.exe
3236	NvBackend.exe

Loads dropped DLL 7 IoCs

pid	Process
4996	NvBackend.exe
2172	QQPCTray.exe
2172	QQPCTray.exe
4228	QQPCTray.exe
4228	QQPCTray.exe
3168	NvBackend.exe
1824	NvBackend.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\NvBackend.exe	NvBackend.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 4168	2172	QQPCTray.exe	85
PID 4228 set thread context of 4372	4228	QQPCTray.exe	88

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\appcompat\QQPCTray.exe	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-filesystem-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\NvBackend.exe	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-locale-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-stdio-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-string-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-time-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\mmmojo.dll	WinRAR.exe
File created	C:\Windows\appcompat\NvBackend.exe	WinRAR.exe
File opened for modification	C:\Windows\appcompat\NvBackend.exe	NvBackend.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-locale-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-heap-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-runtime-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-heap-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\NvBackend.exe	NvBackend.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-stdio-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-utility-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\config.ini	WinRAR.exe
File opened for modification	C:\Windows\appcompat\detoured.dll	WinRAR.exe
File created	C:\Windows\appcompat\__tmp_rar_sfx_access_check_240646703	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-math-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-math-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-time-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\mmmojo.dll	WinRAR.exe
File created	C:\Windows\appcompat\msvcp140.dll	WinRAR.exe
File created	C:\Windows\appcompat\QQPCTray.exe	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-convert-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-string-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\detoured.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-convert-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-environment-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-environment-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-filesystem-l1-1-0.dll	WinRAR.exe
File created	C:\Windows\appcompat\api-ms-win-crt-runtime-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\api-ms-win-crt-utility-l1-1-0.dll	WinRAR.exe
File opened for modification	C:\Windows\appcompat\config.ini	WinRAR.exe
File opened for modification	C:\Windows\appcompat\msvcp140.dll	WinRAR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPCTray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPCTray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe

Runs regedit.exe 2 IoCs

pid	Process
4372	regedit.exe
4168	regedit.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
4996	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
3168	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe
1824	NvBackend.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	NvBackend.exe
Token: SeDebugPrivilege	3168	NvBackend.exe
Token: SeDebugPrivilege	1824	NvBackend.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 4996	2780	WinRAR.exe	83
PID 2780 wrote to memory of 2172	2780	WinRAR.exe	84
PID 2172 wrote to memory of 4168	2172	QQPCTray.exe	85
PID 2172 wrote to memory of 4168	2172	QQPCTray.exe	85
PID 4228 wrote to memory of 4372	4228	QQPCTray.exe	88
PID 4228 wrote to memory of 4372	4228	QQPCTray.exe	88
PID 4996 wrote to memory of 3168	4996	NvBackend.exe	89

C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
"C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\appcompat\NvBackend.exe
  "C:\Windows\appcompat\NvBackend.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\NvBackend.exe
    "C:\Users\Admin\AppData\Local\NvBackend.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- C:\Windows\appcompat\QQPCTray.exe
  "C:\Windows\appcompat\QQPCTray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\SysWOW64\regedit.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:4168

C:\Windows\appcompat\QQPCTray.exe
C:\Windows\appcompat\QQPCTray.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\SysWOW64\regedit.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs regedit.exe
  PID:4372

C:\Windows\appcompat\NvBackend.exe
C:\Windows\appcompat\NvBackend.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Users\Admin\AppData\Local\NvBackend.exe
C:\Users\Admin\AppData\Local\NvBackend.exe
1⤵
- Executes dropped EXE
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140.dll

Path C:\Windows\appcompat\MSVCP140.dll
Size 426KB
SHA256 4190f0a1306257ced4975448794e1d42be312e334ffccfb4910a4a39cde9df57
MD5 0a0042fe544c91cd57bc2f7ef40bb974
SHA1 8bf31f44ba3e47b8b186c3d8cc219a4d2f67da63
SHA512 c4c56c06cd40213ebdcead6a256510b44beefc3a18d7f84efebcd05bac7bb1b942f97b7f7798420ca8ff0c1592f32301d751554fb63125b4703feadfced2f6be
SSDEEP 12288:/gc0BGzePo6+J+4P0xYv7IQgVhUgiW6QR7t5s03Ooc8dHkC2espkWK:R01Po6+J+dxYv7IQgy03Ooc8dHkC2egD
TLSH
T116943932BB464DF1E48913B971C9472193F9FC610362E3C397DAF12A2F566C6A633A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvBackend.exe

Path C:\Windows\appcompat\NvBackend.exe
Size 2.3MB
SHA256 ad2dfda427e3ccb5c8404f0afafe71c64b862d2e26a67e1bfc2b40738fd0b873
MD5 94a8196066774252df015eedf02cca44
SHA1 28b6667f95888ebd0f19d98c4329a17fb1f8f27a
SHA512 a06b1b744493b74592edf63aa7abd73ee170764e58d9e84ccb6e3e320e66d06fedc8d7901b9cd6b4509c7e327c155b87c1846c47299cd5bd08de99293fdbee5c
SSDEEP 49152:UVmYRW+CFZW8VT9PEpgeOmuQieauFPux87IKnMewyW/BrNTx1ZHfxoKdTRvzTSZK:UzWl5VT9PEpgexauFPux877nMewyaBrH
TLSH
T133B57C1277EE902BF4B32770A939976E89B1BDB01935C04BB3501E1E7AB16C29931F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQPCTray.exe

Path C:\Windows\appcompat\QQPCTray.exe
Size 183KB
SHA256 4d20d7781a2edb9476a632fc3b32a503da501ec51707047f48d1fe5f5a23b194
MD5 f67b80bc3877723c0fee541ac2f8f68a
SHA1 6affa30e266b1bb71b40320d8a7fe34fc37d9b30
SHA512 7dc27b4efe4e79068b647dfd7879c2b615cded9e011b2e95f59f67662762fb4e412f8b03efd590269a9a2ec1a63318a623e11c572a10cf8f55b1c2053fa2ac71
SSDEEP 1536:tio1VUIYvl0zxLp4bBr1IZpBp+No14J0EXJigIDEcDexPB9R75:swg0Lp4baBp94J0ci5DEc6xPB9RN
TLSH
T1D7045DC0254A6A23F3B6303D0F69FFED46746D2047C193A73D962A1A2971DE32C2365E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Windows\appcompat\config.ini
Size 127KB
SHA256 32c7e31cabd0f07dcf57fb7d7f5076ea83f169e84db0b98dc22eae5c52218c08
MD5 24ef911f7a79076d50ec1214eae80699
SHA1 9558122dc22f2adc422307539dd4338d2890e2fa
SHA512 73cb2accfacd0418b3b21d0c5043417965cbd80c596bbd4bd5a79ce3229678cf5d95028257138f312b14f2bc7034a5d168636b0d9ba4cdb4a18927a55bd4635e
SSDEEP 3072:8H8IQKNi6Sp9WYbcS4LpNqx3RHl+exgRUW5aW1DWer+rWF6yFOB:0NLC4LpNkBF+6reprmWF6ysB
TLSH
T190D31294EBA70EE9FB6122712119634C27B115848C4DFCE2FB5F18029A1BE35BD1A7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

detoured.dll

Path C:\Windows\appcompat\detoured.dll
Size 416KB
SHA256 df2a1b6abb9959042969046ac3df67fcbd763767d1338d1c8d36efa88cc95f2d
MD5 62833fbe9fc354c2243851d1d94346f6
SHA1 2d530b0c4b8135ff13f37b6f1f42621487ec73f6
SHA512 38c19e6c18834e75df0891c6b7d85ea898b31d0e2ad836b2b76679a5496659dd9af66d88ad94f252807e74bbf60ab3d750d2ac7a0f05de27437c43c20e44e156
SSDEEP 6144:Z/f6vcU+l8via1Ge2P7AEoZ/S1Hj/f256LFa+EjXVrPVJmuj6k:Z/f6vcevA7AZS1y5Ia+GNVQujH
TLSH
T13794D041B982D133D67F09308975DF668E3DBC904FB069CB67844DFA9A705C1AB38B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmmojo.dll

Path C:\Windows\appcompat\mmmojo.dll
Size 19KB
SHA256 dbb503f411bdc847f679394ba721e8d43476a9c493489d7932a4a8701a3466d7
MD5 b8fd8c9809683fefcab1afda7817de07
SHA1 9d17b844ea35e93d83406272ee0952dde5e13483
SHA512 e4418d0727d8bc19f28db520ba267c6dc9430e6cbb2af060d829a7ae5d88c8258690c5d5cc30321c5054a61ffeb5f644a879c56e882ffe6fb0a9b9eedf42bd8e
SSDEEP 384:KjQ5AhNjXeHZB3Rk45k/U3gJdj9ZzgZ2:NAjARkZUZ
TLSH
T18192E941BAA158A7FAAE0774A576863AC9FAFE300B90D4C79BD2011E18701D3F734723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3168-88-0x0000000003150000-0x0000000003181000-memory.dmp

Download

memory/3168-89-0x0000000010000000-0x000000001002A000-memory.dmp

Download

memory/4168-60-0x0000000001210000-0x0000000001230000-memory.dmp

Download

memory/4168-61-0x0000000001770000-0x0000000001792000-memory.dmp

Download

memory/4372-66-0x0000000002D10000-0x0000000002D32000-memory.dmp

Download

memory/4996-67-0x00000000027B0000-0x00000000027E1000-memory.dmp

Download

memory/4996-68-0x0000000010000000-0x000000001002A000-memory.dmp

Download