donutloader | 89cecb3f6b7a2426ed234b9dfdd4502697065c92192965431a4e7fdd5a009d4e

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REQUEST FOR QUOTATION_07.05.20206.js
Size 1.2MB
Sample260706-ehe8qads8l
SHA256 89cecb3f6b7a2426ed234b9dfdd4502697065c92192965431a4e7fdd5a009d4e
MD5 d84e16bc58e81b41694898fe1906d169
SHA1 2d57a43c62ad0491970a585830c5b4917f72fd58
SHA512 81ef3b212a4759950b14fa83eeed1e394dce6bfb3c7969a65156b58dca33490870dfaaf1ffe436f1523b2f3e55c6a6a4cb7491102e83efc72468986a01f33e37
SSDEEP 24576:BySbi6EGkWGMzrAstg8+VFa3a2AIXirmgvfiRAvDBNPZF:3i6y95rKgr3n
TLSH
T170452391ACFE6EA50EC8C31F61B71E454F100B506089DA7F27D7B9E23127F91CA4A61E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/3228-45-0x0000000000690000-0x00000000006DE000-memory.dmp	family_donutloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
4284	vijewyufveonabghulluonouceyasi.exe
2288	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1520	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1520	powershell.exe
1520	powershell.exe
2672	powershell.exe
2672	powershell.exe
1756	msra.exe
1756	msra.exe
1756	msra.exe
1756	msra.exe
1756	msra.exe
1756	msra.exe
1756	msra.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1520	2396	wscript.exe	84
PID 2396 wrote to memory of 2944	2396	wscript.exe	86
PID 2944 wrote to memory of 2672	2944	cmd.exe	88
PID 2672 wrote to memory of 4284	2672	powershell.exe	90
PID 4284 wrote to memory of 3228	4284	vijewyufveonabghulluonouceyasi.exe	92
PID 4284 wrote to memory of 3228	4284	vijewyufveonabghulluonouceyasi.exe	92
PID 3228 wrote to memory of 3796	3228	msra.exe	94
PID 2288 wrote to memory of 1756	2288	vijewyufveonabghulluonouceyasi.exe	95
PID 2288 wrote to memory of 1756	2288	vijewyufveonabghulluonouceyasi.exe	95
PID 1756 wrote to memory of 4624	1756	msra.exe	96

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_07.05.20206.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp195932.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp195932.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp195932.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\SysWOW64\msra.exe
        
        C:\Windows\Syswow64\msra.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3228
      - C:\Windows\system32\msra.exe
        
        "C:\Windows\system32\msra.exe"
        6⤵
        
        PID:3796

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\msra.exe
  C:\Windows\Syswow64\msra.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\msra.exe
    "C:\Windows\system32\msra.exe"
    3⤵
    PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8a27c33da98c9e4aac8037898802f148e8b4a533debc5aa5fcec0c237b18ac8b
MD5 c65685fe40791534cae70febc675be67
SHA1 f2a2946e7f5d53020a34e4f17c896d091e85d2f2
SHA512 9f163b7c100033f996c90d6c826d2d90e589d92cabdb5ba3c268a25cad83b3e4f297b83de6e8f2dcef94a0f360c6a445c3c0f424afb50ecea03778dc6129beaf
TLSH
T1C7215627B39C8A21CC86163A109D9C1176B683C7819EDF9F6BC4D614A07F999CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_34tpdfd1.n1g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34tpdfd1.n1g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp195932.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp195932.bat
Size 1.2MB
SHA256 5a77355e413ed51db926cc596f2f9518fd36fa94a754ed46fbbb8c9190380f17
MD5 5274ff4a37a1544dfab77d17d605bdba
SHA1 3b2653ede78a2c4707ae0cab8944fa0cbe5b5753
SHA512 2267ad8051e2f37f288710727508c72685ea63ec89a128818da9aaba1f4950f4346b8c89a622eeca34a1440f775aad64e2fb13ffbe647a7bfdeab320d742e623
SSDEEP 24576:eZdIzsviB+HEfpgt5F9sjPr2u2FxPVffQagjYdGaB87St38z:eosv/a2uix9jOYdXt3I
TLSH
T130452310BCBDCCFA88ECC724F0FE4F2E6648992D9C749AD72AA160C6177EB491553427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp195932.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp195932.bat.gz
Size 935KB
SHA256 40d649cdb8c08b1d333b9f0fd67b40d7f5fdf6e4180234cdbc602afc83e7ce23
MD5 547f83abfae145741d0e0dea910b3737
SHA1 0528ef94a47008eaf3d511b15c22982ca2290a76
SHA512 1e8ba02fb06e68ffcbcc0b368b2ab454cd0624df266ae25f77d6ed2713eabc04c547bbef85ab42c71858e308bda3b9d3ad5e4e89095d9defaf466a5b4056bf58
SSDEEP 24576:iDvVlac7IauodkoF7itpC+0VeEHMeGdH++cIThmzDzRX:4pkRoWqopC+0FGF+y9mzDt
TLSH
T1741533441F5ABF5E08211DA38105BD4FB6F673748A9E092DA38EE3BA4854731D433A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 310KB
SHA256 8c348cb5aeedaf39f3a2295eb5fa278963562e39a81040e37070bbd56d692141
MD5 e3758886d6070554fca752d77ebb08b2
SHA1 64d8aca48b208a0545dfbadc419348f3eeff7844
SHA512 9823a0610688c932e5aab28b747378d34a4ea0551089d1136935a4538bd239f42ce18779c026a95d79149e81e2e38677a82415d095301edc9cb85f512cb9cb5a
SSDEEP 6144:/xxuICqAy2Py6o50/T3VXSaKbK9jeuTejD5atj8OHFXaUy+dV:HR1Ay2Py6DTliaeK9j6jD5oj8OHFXWWV
TLSH
T1CF641244973224CC97F55D4EE7158A2F495B8BAA0962CE4D5FA7B84AE793F2337B0200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 5d6462d38e0302bc438956182201b912d227a33fcbe679623310b6ad57567863
MD5 3d4260109b0bb35439d4609d12b89d98
SHA1 ce75483e401f009fd0dfa767a9e0f2ed4856c4bd
SHA512 627ad4e92c35a2ab922a382618b4ea6d3aa9234b02d1b910e281cf46acb7e3b2277408f72e6b154658cd28bfcd6248222f49f8ed7d440b79954f93eff8868c0d
TLSH
T18531E0981E77E6430265D3CABE3BCB037B185995A1AD06523BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1520-8-0x000001D1B32E0000-0x000001D1B3302000-memory.dmp

Download

memory/1520-1-0x000001D1B3340000-0x000001D1B3350000-memory.dmp

Download

memory/1520-2-0x000001D1B3340000-0x000001D1B3350000-memory.dmp

Download

memory/1756-49-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3228-45-0x0000000000690000-0x00000000006DE000-memory.dmp

Download