donutloader | 1f2766971b02e8e7014e8c31071d8cede5288768c986ebd81452437dee15a6d0

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update_l5xmfb.bat
Size 657KB
Sample260705-pdfnssct4w
SHA256 1f2766971b02e8e7014e8c31071d8cede5288768c986ebd81452437dee15a6d0
MD5 0d1316c3d60ce063dbc0299a7a00c341
SHA1 97471ea4755913626d000e61ed9c8664dd2c800b
SHA512 ea53d485f157f28975612f58275579523a888af5270f5b57f335c214b083d57e15b5d156b1893f54489281e1bb793973a69718242ac8e811fc9c999c5297b36d
SSDEEP 12288:kQQyMmiW6+/uP7zGtVWYwEdz7iXjX7u3LolMr/N7LGTkxk:FMMuP7zgw8nyPZ6FHxxk
TLSH
T18CE4237E3F86A9557C2D9896DB3DA40C7C2FF0A74BB4CCA0A987F0B251554C8BB1C41A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3460-3121-0x0000000003BA0000-0x0000000003C0F000-memory.dmp	family_donutloader

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5992	certutil.exe
3364	certutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2920	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2920	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1096	rundll32.exe
1096	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3460	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeDebugPrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1128	4144	cmd.exe	89
PID 1128 wrote to memory of 5992	1128	cmd.exe	91
PID 1128 wrote to memory of 3364	1128	cmd.exe	92
PID 1128 wrote to memory of 1096	1128	cmd.exe	93
PID 1128 wrote to memory of 2920	1128	cmd.exe	94
PID 1096 wrote to memory of 3460	1096	rundll32.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\update_l5xmfb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\update_l5xmfb.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\aglgd.b64" "C:\Users\Admin\AppData\Local\Temp\usbmon_l5xmfb.dll"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:5992
  - - C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\mohap.b64" "C:\Users\Admin\AppData\Local\Temp\own.enc"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:3364
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\usbmon_l5xmfb.dll",Run
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1096
  - - C:\Windows\system32\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aglgd.b64

Path C:\Users\Admin\AppData\Local\Temp\aglgd.b64
Size 2KB
SHA256 14e2410940acfaea07cdd93c1f190ab9369723edeb4cd9e864f318e1c2745ddb
MD5 ac3058b3d49a23a1bb90e3107ffcba82
SHA1 0b4d5083896f4557b9a2e9eb4b58e4d768f0e328
SHA512 c01bf3f712ee4ee6ad28b0f0a3331eb4d90fa1d39a272865bd275660a061c939fcce081c93efbc0b584c7364439d41bcf672c6e03af729aba09bad010de8a014
TLSH
T1B55110774467FCDEBBB41C84C90436884CCC2E4B4739D45ABF8860AA76D102ADED95B0
MD5 SHA1 SHA512 TLSH

Submit Download

aglgd.b64

Path C:\Users\Admin\AppData\Local\Temp\aglgd.b64
Size 3KB
SHA256 9830409b7711622fbaf91bcce957d6e5c8f0a43db7bb2485546dc7d40482440b
MD5 ea36755fb54788526f6bd624fb6172f4
SHA1 4baa3e4a4b86352832d8153299e8f1eea4b59f8f
SHA512 6cc9d48db7f3cf08a594f7171ee86d9821fe3cac6a7d23c5febfbe1a087b4237751eedfa4dda8d324ef0b8d507e4bdc2312d75ab64394a8048f5401448fb0137
TLSH
T10A81747E142BBCED7BA86C98941021894C8C398B0329D486FEC8709BB7D1069DEA55F4
MD5 SHA1 SHA512 TLSH

Submit Download

aglgd.b64

Path C:\Users\Admin\AppData\Local\Temp\aglgd.b64
Size 4KB
SHA256 74c4aab72a337e110fc4ddd6b5b6218d4056fbfa514ad7413530697fd63ba2f5
MD5 57d3f0e567997c0ef80fc737d61813c3
SHA1 189c3ecb4eea1244c840bcd0d534a73ed5862072
SHA512 3106c94861ba292658bb45ac9b155c473ac917f2cf475dfbb29204a4c699258e35239739f11be86e8cf913631fef0b2ab4a6b63e1b5be46c4c2f4b7b9b674224
SSDEEP 96:LrDeVAeDZ/Fia8WKDBa78n9xJi+8Ykv/c5mt/bFzCEMOvgpgLrFtHqpHzMb:HDQ8HDB5xJiLjcMRM92FFqhC
TLSH
T130A1B6BE151BBCEE7B6C5CC8500071984C9C398F4729D085BDC870EAB7E6066DE756B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aglgd.b64

Path C:\Users\Admin\AppData\Local\Temp\aglgd.b64
Size 18KB
SHA256 b1e169fa75293347f5ff3d7f041600d9b7081bf7cd1224f8679ce496d207c98e
MD5 a26e84bac9a1e3aeb4b2e283cb310df1
SHA1 a15de30ca4531655bc5970c8d7009396215d15b8
SHA512 b14c4856097903d9b2a17c5f6ac5f5d209f7402e46eab838698bfa2ead9af9af9e791ce475a6763552e607f122e001810d8c04a5b3dd851af2c1b47dab5ae693
SSDEEP 384:HJjB5PEjxrcSuVOZixt+4TrXWYPj26jqBvM3:pfPEjxr+VOZixt+Cr/j26jqG
TLSH
T1FC9209BA1D4B7CDA6B795EC9580075908C687ECB6334C087FDC870DAAAA6071CE259F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mohap.b64

Path C:\Users\Admin\AppData\Local\Temp\mohap.b64
Size 4KB
SHA256 57683ef778d863afebb3169c5277f7517fc548c14fe39afa2e18104f7884a2ee
MD5 0768ce27abebf447b0cca8b9f4bdf7d3
SHA1 66116c526fa51ecb31a5fd16d44ca66fb02f0d26
SHA512 3d7ac1b1058072cacc711419f7d9a746f1997376933fd7b5d535306de665aad8e7f1eafca3ae38fcdbcda559af4275c6de7c87e9baca128b2986881adbfee016
SSDEEP 96:LrmN36YumFJdqzWLCerZYIf/6hS4j/T3ED6X8ZR8zEq3OnGRIjp/:Ha6mFrAWLlO8/6hHkD6XsRIEqp6jp/
TLSH
T1F3A17F4A24D3C4AC48D876C0B68BDADEB9D0BE8509A329C4237B14D967B4318F818D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mohap.b64

Path C:\Users\Admin\AppData\Local\Temp\mohap.b64
Size 595KB
SHA256 aaaf515ba3d4c6b5aefc0bd4b91b5d9e15dee198f923abe056ebb70d537b2b5d
MD5 a7be254db14101c838815e9ae4dd7fb2
SHA1 fda81b9e522eaeb7de7948a6fc29c87e1f46f9c8
SHA512 d17d260f9619ea2cab6e76e9ddd7314e6552cf907a103eb677f310be8cee0f7d8976c6cce725a4cd1d557bf0eb96ac9756d27f24c89330c5dd13e0378a87ee4f
SSDEEP 12288:Mwmcqqm2i7mnFQaxdCiWOUvf0w79IVIrc1UAEtGN7M1istu:sckmnyaPUX0g6D2m4dtu
TLSH
T174D423B895C7CED68D3C74B9B72FB408943540DA8C9961F65FC8E0F361BA908D7A9842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-3127-0x00007FFE94790000-0x00007FFE9479D000-memory.dmp

Download

memory/3460-3121-0x0000000003BA0000-0x0000000003C0F000-memory.dmp

Download

memory/3460-3123-0x00000000078F0000-0x0000000007960000-memory.dmp

Download

memory/3460-3124-0x0000000008890000-0x00000000088EA000-memory.dmp

Download

memory/3460-3125-0x0000000008EE0000-0x0000000008FAE000-memory.dmp

Download

memory/3460-3126-0x00000000071D0000-0x00000000071D6000-memory.dmp

Download