donutloader | 7de2483d97a87d347b12c0efb2b9f8c7c736f55bf40b6372aaf9d8851f6f27db

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHELL.exe
Size 48.6MB
Sample260623-xp2dmsfx2x
SHA256 7de2483d97a87d347b12c0efb2b9f8c7c736f55bf40b6372aaf9d8851f6f27db
MD5 f169933dd69d194d8f5addfcf9388542
SHA1 61cd57747adc030bae87ed2f6d5bebfd80fdafe1
SHA512 da2024f891a06c0dfaf86fd952717195d4a23867f3ccee7bf04234181fc9fb662c743eb3abc980d86d64021cb69a26aca659c847ffe93443233bba5c5f4a9dac
SSDEEP 12288:Iquze1wkjOIIKjgj3ukoSwJ27mAHpvxaFVakXgPpe1dj/+44nMWFxCLRaSfJ5D5i:C
TLSH
T1FBB7FCDEA71D56E90EDB37A8EB464963BE84A9350A74824FF7AF851FF00F81500F0916
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4568-25-0x0000000039AB0000-0x000000003A2C7000-memory.dmp	family_donutloader

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4568	SHELL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	SHELL.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2832	4568	SHELL.exe	93
PID 2832 wrote to memory of 2100	2832	csc.exe	95

C:\Users\Admin\AppData\Local\Temp\SHELL.exe
"C:\Users\Admin\AppData\Local\Temp\SHELL.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mhstzba3\mhstzba3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F2B.tmp" "c:\Users\Admin\AppData\Local\Temp\mhstzba3\CSC6F8CA95AC45C4AF98524A85EB19EF464.TMP"
    3⤵
    PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES8F2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8F2B.tmp
Size 1KB
SHA256 29cfaa9f67661775008c88d66a2110e34e8628e9bcdb9d824c0b31780153fefe
MD5 edfe3dc1d2f7f4e77dbfa27bde0ec50b
SHA1 37916bff4121e466bbc3e7ebfdd7e490414a4441
SHA512 1afd7261782e368ef4ad3c24a333b0721f53def4455db92d4eaa1a10dd8f376c1f2109adaa9b017be8b56549f58d9f6e072ea2e35117f79c1f68bea1798dadf7
TLSH
T18C218C0553E84B0EF0771731ADFA471BA234FD69EF62A75A8580422C1C51504EEE1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bsdhoy2z.c1m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bsdhoy2z.c1m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mhstzba3.dll

Path C:\Users\Admin\AppData\Local\Temp\mhstzba3\mhstzba3.dll
Size 4KB
SHA256 ad80e0325e1681aa15eb9f1858dea3595ca3e3ce20d57b0b9085258162fcb80e
MD5 421c4f681bfd90c7021110cc00b6cfe4
SHA1 af1403c913c3b4116bd01f603dffdc9081cc1fdf
SHA512 9a79c3018252d3bd2c6e0255c3b28e8f8569db2434dd19a7e40c1f3ebe39ef220a23ea9dcf6f7bbddd2abded34237f7aa790130a09149ca41c4cfc0547331cf6
TLSH
T15F81341697D941A7E0AB47706DF3471623F8E890AB735B0E19C443696C753604F32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6F8CA95AC45C4AF98524A85EB19EF464.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mhstzba3\CSC6F8CA95AC45C4AF98524A85EB19EF464.TMP
Size 652B
SHA256 7598f071de9537781acf981a8236206cab0612eb92254958fc1a64d6030d302e
MD5 faec01dff472fe419856ada97759810e
SHA1 0e9d2b74b8f49f0bf98b55de8f35423e3f10c3e9
SHA512 98fe13c556c6fe549859104dae7d1a13a613d89a40898e7797228ec2216296142fc8b45f5813c16cdb05ebdf0223645555b6352a4abe4b1b593509735305b3d8
TLSH
T1DCF0544A63F8020EF0F34B30BDF543A39168BC65DE3393ED1980035D18645109A72F71
MD5 SHA1 SHA512 TLSH

Submit Download

mhstzba3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mhstzba3\mhstzba3.0.cs
Size 1KB
SHA256 225a6d52790b53f0219d616ffd2876ea0b3465da568b0c6ec9c209b62b3a848f
MD5 9be2cbd3142c7e13f3cc439371f552d6
SHA1 2749c5ef1485e8a56ef418dd0afe7ffa825cd8a1
SHA512 8523aff87081a55dd4187f89511355b140a8936e24a2d4375c318f5e6850ca10e544779ae9f188c66f9c442468e05c43b9c80e1d4f8818856f137f5e1bed03ff
TLSH
T1D431FE91032547EA59B309264E8CF40CF31B41331A7E1E06BFBC83A19F7B424E72AB59
MD5 SHA1 SHA512 TLSH

Submit Download

mhstzba3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mhstzba3\mhstzba3.cmdline
Size 369B
SHA256 ab07b83f6019d22b8d0dddbc530d0c5af247d59aa6ba73ebc02e2d5ec4453db7
MD5 bcaab336926ec40b5345b92809561f2d
SHA1 5aa654cdeed21fbfc99bbe6c4caed001d36c8190
SHA512 3c7d4d35c5449afee30afdb6ddee46bbdefc096bf0c31a6e7719175106191822457394e8e92d029046285cf9c892c3d14b8dcd985171e4c1078d1716b24b823a
TLSH
T159E0683A42A6C27D13D9280F35ADE4AC927216432A853F847040C42FD01B80277D1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4568-0-0x00000000001C0000-0x0000000003258000-memory.dmp

Download

memory/4568-10-0x0000000020030000-0x0000000020040000-memory.dmp

Download

memory/4568-9-0x000000001FF90000-0x000000001FFB2000-memory.dmp

Download

memory/4568-8-0x0000000020030000-0x0000000020040000-memory.dmp

Download

memory/4568-23-0x00000000054C0000-0x00000000054C8000-memory.dmp

Download

memory/4568-24-0x0000000039AB0000-0x000000003A2C7000-memory.dmp

Download

memory/4568-25-0x0000000039AB0000-0x000000003A2C7000-memory.dmp

Download