donutloader | cd368170dc9f51be621d232020b5e2be0b1a157fea254d8ea10717ac1b606e10

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_cd368170dc9f51be621d232020b5e2be0b1a157fea254d8ea10717ac1b606e10.js
Size 1.2MB
Sample260707-pa4lfset9q
SHA256 cd368170dc9f51be621d232020b5e2be0b1a157fea254d8ea10717ac1b606e10
MD5 9eb67e33fbb70286322d166682ceca4d
SHA1 e7b9a6939eefb4e25f3e2919d1a0174e5028fbaa
SHA512 e158cdea8086d233630574a97054a9edafba13fe0f4014a0b1baa7bf6fbb67e474c89160daa7e4dd6308ac579c13aa24a65124d03818b006b2eef9bb4986a9d9
SSDEEP 24576:jMvjJUI1KItY6faW9iyv68yR7JUWouevuKasT8LzwKSCMj:xIt/9x2euSOa
TLSH
T1CA4533820FA5965E09D8CA2A547FAF6D0FCD5F56AC600AEB93EC70C70B19E468537813
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/264-38-0x00000000003B0000-0x00000000003FE000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
240	vijewyufveonabghulluonouceyasi.exe
6008	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5760	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5760	powershell.exe
5760	powershell.exe
5924	powershell.exe
5924	powershell.exe
296	msra.exe
296	msra.exe
296	msra.exe
296	msra.exe
296	msra.exe
296	msra.exe
296	msra.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	5924	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5760	4260	wscript.exe	87
PID 4260 wrote to memory of 3716	4260	wscript.exe	89
PID 3716 wrote to memory of 5924	3716	cmd.exe	91
PID 5924 wrote to memory of 6008	5924	powershell.exe	96
PID 240 wrote to memory of 264	240	vijewyufveonabghulluonouceyasi.exe	97
PID 240 wrote to memory of 264	240	vijewyufveonabghulluonouceyasi.exe	97
PID 6008 wrote to memory of 296	6008	vijewyufveonabghulluonouceyasi.exe	98
PID 6008 wrote to memory of 296	6008	vijewyufveonabghulluonouceyasi.exe	98
PID 296 wrote to memory of 932	296	msra.exe	100
PID 264 wrote to memory of 2816	264	msra.exe	99

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\_cd368170dc9f51be621d232020b5e2be0b1a157fea254d8ea10717ac1b606e10.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp538417.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp538417.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp538417.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5924
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6008
    - - C:\Windows\SysWOW64\msra.exe
        
        C:\Windows\Syswow64\msra.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:296
      - C:\Windows\system32\msra.exe
        
        "C:\Windows\system32\msra.exe"
        6⤵
        
        PID:932

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\msra.exe
  C:\Windows\Syswow64\msra.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\msra.exe
    "C:\Windows\system32\msra.exe"
    3⤵
    PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

tmp538417.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp538417.bat
Size 1.2MB
SHA256 7fd698af654cc2f4deefb18561f5e086803f93bf2cd2f739a26f4fbb9aa705e4
MD5 32d330b1dbc1586048192f9741a45dab
SHA1 6e55c6af43cebf0f879660d8ad9d6443f6f06075
SHA512 96f966454b7410d75ce83e2d58db63b8d8c1fd162ccdedd4a1d5fa0caddaf3d0247848f4d7f927a56cbedcd4d85e63e9602c80f267c4d10c3522dfea80b175ec
SSDEEP 24576:asKu43b9g8Cu53WF8ZUgqylwNrEGm7+tUq:jKtgzQBSHrEGm6tUq
TLSH
T1D74533008DFB4D6B81F8963DE0DFCF0667724B2564DAD26B0D85B443162A7A90DA34EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp538417.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp538417.bat.gz
Size 935KB
SHA256 ce4c17a4d30720ff03a10e5d803f6c31f45cc33299e9308fa6a8849a36cab29a
MD5 817a5e2a0fefecb794831b4a1684b5b7
SHA1 c0e55612badb0a966c9a9e91adf3d5fc0f97294a
SHA512 a04c13afe62ccc97b84cb7d96805e64d55e5a101c58fdecb9a5046aab7c17c78b659a686e177f34c0fa88a7dfbacfbb7ee7238ec344cb2437c2f97fb079696f4
SSDEEP 12288:tUulr/vWCAmRNotpKV9DebRX3iz2tqjtN8O56BS7FUXK/k24Obxhb9ceHVLoJIrl:tUuVP19abdPojWSZTr1hb9dHVsJg
TLSH
T1FE15334A8FA50C03DC144BA7C9DF42A549EE21ECD7BA741A2E5B8DD06A31CBF5174EC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 310KB
SHA256 a0f445305612870ab20a681cc49416e0da655b25fcd0ad44cfa1b7d03f65a6cf
MD5 dbb71dc5ae6f6eabd58dbfd6dd751a34
SHA1 a72f1b243b7a132adaa01c1bb4298b1c65e09ea8
SHA512 1725a92a39308140de25c64c63318221c73e16bf7e9f0f7fe20a1b21cec47a4f1633112104005ac33aa9d908eb2b6e7c5fc909109bddb1cc8d3a46c22163f514
SSDEEP 6144:/lKnIzgLN/w2IIJED+7Ij5Cp9efg4KzAgUoj73AbS9uaUy+dV:Xsx5SD+7w5CPiKznUS2WWV
TLSH
T16A64128946437DEE6AA484696B6ACADD06782A1D8530CC794FDCA35CE37FDAD730070C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 5d6462d38e0302bc438956182201b912d227a33fcbe679623310b6ad57567863
MD5 3d4260109b0bb35439d4609d12b89d98
SHA1 ce75483e401f009fd0dfa767a9e0f2ed4856c4bd
SHA512 627ad4e92c35a2ab922a382618b4ea6d3aa9234b02d1b910e281cf46acb7e3b2277408f72e6b154658cd28bfcd6248222f49f8ed7d440b79954f93eff8868c0d
TLSH
T18531E0981E77E6430265D3CABE3BCB037B185995A1AD06523BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-38-0x00000000003B0000-0x00000000003FE000-memory.dmp

Download

memory/296-40-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5760-10-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/5760-12-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/5760-14-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/5760-16-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/5760-4-0x0000021BA33D0000-0x0000021BA33F2000-memory.dmp

Download

memory/5760-5-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/5760-1-0x00007FFFCA9CF000-0x00007FFFCA9D0000-memory.dmp

Download

memory/5760-6-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/5760-9-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/5760-8-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download

memory/5760-7-0x00007FFFCA840000-0x00007FFFCB1E4000-memory.dmp

Download