donutloader | 05ce8e946a4bd4c8957d87e159acecab0e930a150c07f4124657c527ce4edf13

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_dc910223be66140b45bd021926717749_cobalt-strike_elex_icedid_njrat.exe
Size 805KB
Sample260705-fdks3sds4m
SHA256 05ce8e946a4bd4c8957d87e159acecab0e930a150c07f4124657c527ce4edf13
MD5 dc910223be66140b45bd021926717749
SHA1 207e7a000182583f878a1ac4c64ed6b3fe3b7ef1
SHA512 222eabc9d37784b9908b7c59a0747d73e9c5026b50b758cf416d0011fb632614979565b36bb2c17ff665be2381736cb00a3fa38033b529779c41b6b184e06d4b
SSDEEP 12288:CabExp8hsavOpFhcShyrtFne8yEt1ZXET57Mey9GFVer5+nHer5+nZoyg:C8ueeavqFuPejEvWN7MeEsXE
TLSH
T1E205F10D3A69A8D7C9324E34AC744696537268C37E911BB768D4530E8C7B2F88E67F34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/1676-0-0x0000000000BE0000-0x0000000000C72000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
4872	oqbyu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_dc910223be66140b45bd021926717749_cobalt-strike_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oqbyu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4872	1676	2026-07-05_dc910223be66140b45bd021926717749_cobalt-strike_elex_icedid_njrat.exe	88
PID 1676 wrote to memory of 6048	1676	2026-07-05_dc910223be66140b45bd021926717749_cobalt-strike_elex_icedid_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-05_dc910223be66140b45bd021926717749_cobalt-strike_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_dc910223be66140b45bd021926717749_cobalt-strike_elex_icedid_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\oqbyu.exe
  "C:\Users\Admin\AppData\Local\Temp\oqbyu.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 362B
SHA256 b0f42d8c0a7a17d021f5d622b874e5102252fca76748e469e1ef6e37dcbb1502
MD5 442862aca4dd8afb8fa88f7513221b18
SHA1 1b8e9b0cbbec7b9d51b3e8c5dcefa46624dd3c3d
SHA512 15bad1edb72a6fd34c2f287a51f4a51d7e072339d6dc737abb7b1e4e2529cfd538ee22316129ec3b5f7bd572be96f452cc416c103c1c3fed53345e0881f6339b
TLSH
T1ACE0D801419FCADA041472A709EA689CC0545C582F863704E7D4C55C22D491EF6D26C2
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b17f8ebfe0b6415138929bd0a52a3d0574d0b73c250358ced9b6b5d6689481cc
MD5 f30fd7e709450382118487720d6f0eb1
SHA1 6159dcfae5f84dc0ac7d34ea45c0f98b411b6e3e
SHA512 3dc357caf0211be834460d8b6ed6cf132c1e5f413ef218a6e3129c96dcdb9c268415055808ee7d2c3375451439cbdfb0402999cbdef2f7d609cb2135a4a2fd2e
TLSH
T17DF09BF55056F0713512D513C3F46BD86B971DC41EC3EC98010875714DB5D1C8584756
MD5 SHA1 SHA512 TLSH

Submit Download

oqbyu.exe

Path C:\Users\Admin\AppData\Local\Temp\oqbyu.exe
Size 805KB
SHA256 761abe2a912c10ce37da61747716140f9ee8ce83bbff1dcd4925571805cc34fd
MD5 8e80adbd592a46deddf0879a8b99aada
SHA1 7be388b43db4a6959deec07f6a376ddf21c32403
SHA512 84956a4d36894209096f2a6fd067f780650b779a96b8ea372789107c3a4d5436af712478bd67e267676d4f23fc2b5ef397a1a6cbcb34840d27f54126a6f47f8d
SSDEEP 12288:CabExp8hsavOpFhcShyrtFne8yEt1ZXET57Mey9GFVer5+nHer5+nZoyv:C8ueeavqFuPejEvWN7MeEsXT
TLSH
T1D805F10D3A69A8D7C9324E34AC744696537268C37E911BB768D4530E8C7B2F88E67F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1676-0-0x0000000000BE0000-0x0000000000C72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads