donutloader | b27070a8cea93bd95ce8dc3e70a69391138f030bc8e48927bcd16d87e492b67a

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO6766.js
Size 1.2MB
Sample260708-xt3ghaft7j
SHA256 b27070a8cea93bd95ce8dc3e70a69391138f030bc8e48927bcd16d87e492b67a
MD5 64a4b10788863ad0924fa6e73d114a42
SHA1 03f56c4f9a1a7ea34ce245e854b4ea4b62398254
SHA512 b9ec4514f5780d74000a13051a7832a1148cfd951ef660709549d366baf14b8b28845a7ceac1a3c313ec1d9e12c631ac60b6f49a0a4d245655a9f8d4c997b09f
SSDEEP 24576:NfFA72UdMjbGrQFqbE1cK5lxT2Sy6J5+tiFseAJQqgB8+OPzhHJNU0y:9GM+OcM2S1i+uJi+dz7N9y
TLSH
T1F0453323162CED5F15B5D32845AB9EAA1E700F816848F2BF67192DC6193FF24613BD2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4400-37-0x00000000012D0000-0x000000000131E000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
5132	vijewyufveonabghulluonouceyasi.exe
1060	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6104	4400	WerFault.exe	97
6044	2016	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2856	powershell.exe
2856	powershell.exe
2536	powershell.exe
2536	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2856	4780	wscript.exe	88
PID 4780 wrote to memory of 2852	4780	wscript.exe	90
PID 2852 wrote to memory of 2536	2852	cmd.exe	92
PID 2536 wrote to memory of 5132	2536	powershell.exe	94
PID 5132 wrote to memory of 4400	5132	vijewyufveonabghulluonouceyasi.exe	97
PID 5132 wrote to memory of 4400	5132	vijewyufveonabghulluonouceyasi.exe	97
PID 1060 wrote to memory of 2016	1060	vijewyufveonabghulluonouceyasi.exe	101
PID 1060 wrote to memory of 2016	1060	vijewyufveonabghulluonouceyasi.exe	101

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO6766.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp320617.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp320617.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp320617.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5132
    - - C:\Windows\SysWOW64\msra.exe
        
        C:\Windows\Syswow64\msra.exe
        5⤵
        
        PID:4400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 84
        6⤵
        Program crash
        
        PID:6104

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\msra.exe
  C:\Windows\Syswow64\msra.exe
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 80
    3⤵
    - Program crash
    PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4400 -ip 4400
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2016 -ip 2016
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0c0236308733cd437634732f61af1affd87d2d91e3c6a64130109a95b7ddb1b1
MD5 02cc65f25d52eedc3ee2f4a9e1d0a67e
SHA1 e048c6dccd164d383b45ab3545598093a6ea5999
SHA512 20a8ae1113ed3895904f2db07bc6489d2c1d5cf361edbdbc57657a2d9139db7d4b738690a40dad986368633a6096c8525bf1e89010e16a8ba67362b668d6099a
TLSH
T186215C37B3DC8614DC9A413A50CDAC1036B5C7D7419ECF6B7B84D544B42F699DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

tmp320617.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp320617.bat
Size 1.2MB
SHA256 00d8ef09b9aa772515e952027cf978e5d2f1fcbeef9d69d07e529b9a8635a2a5
MD5 91c15d51a25f8a52e2e791762177642f
SHA1 765c4add2cfa9063bf96aec3784030cdc72da7f3
SHA512 80fdd18210097fb8fe7cd48ee3bf7d2c185319355eb67f1145ee08aead8bbf107f03ed172dcc0793a65b7c149007f00dd2e06167b794bee9c6fa743e63fb30e8
SSDEEP 24576:5X22aze3/kpabWbIUlBg/v0A1S2hNUJPtpVsB1x4e8SrHnidNwQvpLge/E:tkpf/lzA1SJPUtw00pE
TLSH
T1B245238459EE0CBE5ACC763890BE8E264EDA1FD75418B9FF13E4F9C10856B8D106B8D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp320617.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp320617.bat.gz
Size 935KB
SHA256 004a688273a680e173c59ad5bb1225203325371adcafe0cef2c92df94d770217
MD5 c36db992c5641aa5d3095fb6f97623f3
SHA1 ab487d3f72b12fbfbeec7e8c8d7686fdf20c9b5d
SHA512 b73291487af2a0fe0a013ceed3f83d1142892c2025675f7953d6c15de888f335af2b121b9d736e57b71b3a4aadb5b09e0eaa1e2a5fcc74bbc0cccdfb9932f4a1
SSDEEP 24576:Oke+WUEzU1d5pZEutrvd17+S+xtzOBRTHvXO8yLcjqL:OkeGH93+SktzIRjW8njqL
TLSH
T17A153358FD3B73A28FDA879E8B33D12C16157E5920C10F3A41191277BE8178E4BC5A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 310KB
SHA256 2a63d6c33f393ff44ea3f3c3788eb58cea897b2cfbc8fbd45dcefc5364381f4a
MD5 ee595a5c8e6e2ef7e085ae6684d5ea4f
SHA1 3a53b5f4a9b0bb195bd3d0731dd4bc2611298280
SHA512 8a0f139539317e259da06a77cddc53816d6b995624f998f7d351c400ff138dc7d4a2551ecaccb33ff53a35a45f56ee07bc1a05c064ba6ea5988cf50fb9116faf
SSDEEP 6144:5/MJ+jUfEeVKbxl3NikhESJbOBlxeGT//I3gl+DYKO3ZNnDN/LygGaUy+dV:ugjzbxdNpuSJbOBlYqYDYZlDh2WWV
TLSH
T11864125089356CBF63B5BD9C9B584CFED9351F354C36CE486CBB910AC392A8A7B14B04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 5d6462d38e0302bc438956182201b912d227a33fcbe679623310b6ad57567863
MD5 3d4260109b0bb35439d4609d12b89d98
SHA1 ce75483e401f009fd0dfa767a9e0f2ed4856c4bd
SHA512 627ad4e92c35a2ab922a382618b4ea6d3aa9234b02d1b910e281cf46acb7e3b2277408f72e6b154658cd28bfcd6248222f49f8ed7d440b79954f93eff8868c0d
TLSH
T18531E0981E77E6430265D3CABE3BCB037B185995A1AD06523BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2856-11-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-9-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-1-0x00007FF88477F000-0x00007FF884780000-memory.dmp

Download

memory/2856-13-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-14-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-16-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-17-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-8-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-7-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-6-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-5-0x00007FF8845F0000-0x00007FF884F94000-memory.dmp

Download

memory/2856-4-0x000002DA39360000-0x000002DA39382000-memory.dmp

Download

memory/4400-37-0x00000000012D0000-0x000000000131E000-memory.dmp

Download