donutloader | 426d270bbe767395859f971c5c8c5ed961162b383d9c0cdce34305fc2daf36bc

Analysis

max time kernel
149s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REQUEST FOR QUOTATION.js
Size 1.2MB
Sample260709-kf9bnsf16v
SHA256 426d270bbe767395859f971c5c8c5ed961162b383d9c0cdce34305fc2daf36bc
MD5 3f3a1f09bd3c7ea97c5218b67f5b88a2
SHA1 3643717e9b93949345af32c9c984ee8dc58c5a41
SHA512 f4244d3b211e0527b79bb014fcd31009943d1459eee04e7392cbe9e82ed268b798a61fc30877b88ea9bc58fd3f789d3c3fb3becf427d441cb11467567f3e41cb
SSDEEP 24576:OjY1D6919DiSOpysphVOVD8RQa5RxlJc/6i9IduZYjq1TWgZpN:biCyY5dBlJM66IdY3fN
TLSH
T1B04533E12F1AD8A642B48767507F051D79D60AD4CCE896CB53EAF0D9C0E67A3270BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2376-41-0x00000000003B0000-0x00000000003FE000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
4500	vijewyufveonabghulluonouceyasi.exe
6064	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2280	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2280	powershell.exe
2280	powershell.exe
5612	powershell.exe
5612	powershell.exe
5496	msra.exe
5496	msra.exe
5496	msra.exe
5496	msra.exe
5496	msra.exe
5496	msra.exe
5496	msra.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 2280	3632	wscript.exe	88
PID 3632 wrote to memory of 3344	3632	wscript.exe	90
PID 3344 wrote to memory of 5612	3344	cmd.exe	92
PID 5612 wrote to memory of 4500	5612	powershell.exe	97
PID 6064 wrote to memory of 2376	6064	vijewyufveonabghulluonouceyasi.exe	98
PID 6064 wrote to memory of 2376	6064	vijewyufveonabghulluonouceyasi.exe	98
PID 4500 wrote to memory of 5496	4500	vijewyufveonabghulluonouceyasi.exe	99
PID 4500 wrote to memory of 5496	4500	vijewyufveonabghulluonouceyasi.exe	99
PID 2376 wrote to memory of 980	2376	msra.exe	100
PID 5496 wrote to memory of 6032	5496	msra.exe	101

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp748264.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp748264.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp748264.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\SysWOW64\msra.exe
        
        C:\Windows\Syswow64\msra.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5496
      - C:\Windows\system32\msra.exe
        
        "C:\Windows\system32\msra.exe"
        6⤵
        
        PID:6032

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\SysWOW64\msra.exe
  C:\Windows\Syswow64\msra.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\msra.exe
    "C:\Windows\system32\msra.exe"
    3⤵
    PID:980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

tmp748264.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp748264.bat
Size 1.2MB
SHA256 3f8fa99e3499348167317e80992693e08c6d4bca02627186686ab107af5d4b83
MD5 5f4f1396ed3dc9b2fa0f1fb258fc0e20
SHA1 f2ad54fc5bfc89ce25ad637196f491de2e4f1cc7
SHA512 b1ff1a6f1ae4a067e0e1b1b2a66a2f9b7b6999109e2d4bb24ff304b915a37e84d5762eb962ff3685eae7712bd032cb82cc4958cb6f06a0925727dd754c2de4d9
SSDEEP 24576:egXR+S0Oy1TuBg3OuvcAd6E44r1NN3As9eyH7/TCBqFWqluM80rgq6:hXUf1TbfrpAUucrr6
TLSH
T1AB453362DFAD89FB4A4C1168713F9709AA723F78C05890B7C6D763C3B98A713545B02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp748264.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp748264.bat.gz
Size 935KB
SHA256 b37d015f99fa1fb5d37a860e67a99a79b6f0a2151f5bf40ce7eabbc0a924bc13
MD5 45c99e0bac8d6f7dee507325ea26a831
SHA1 f04673a5a553b7f21834eed4b11fa0f8141a664a
SHA512 794a58c389546270582262f892aed8e0d2a9fd979e161e609c0b101d351ae8a07f65238b8eed34b74e417fdda0cf3a1e45c2ab679d35a4c81ea0fa81f834efeb
SSDEEP 24576:5JRmsNSxVPLoW9KWybmxrciEgaw5TgDVANYP2:dNNiLT98bmxTEgaw5Tg5S
TLSH
T1C815337D330B732BB90692555DF9009D58D0BB0AA66829E23F95902F4BE172CDCEF2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 310KB
SHA256 4b666239e5667e41301c5f096c0667dbf04b7bebb20679c0981a0472452ab392
MD5 dde532cb5423d9cda3d2dc805a283770
SHA1 e46b357939d8c1748e0cf3955826132b4aa12018
SHA512 6f9784f863f7b3f589699b336cb62c69707481bd7bb8b38cd63c89879f932e44467da5599151841e991f9671cc44f453eb8e52de36c5ded2cabb44bff9b6db1c
SSDEEP 6144:wxKBR7DtDteeiym3bfOgI6Rf3G4AEIuM8dQLd9NaJxzXyiFAWv4OaObMSVv81T6g:667hY8OThI6t3G4AduMVx9NaJxzX92Oy
TLSH
T1BB641389C7EE65EF19A54BDFCE8A0D2702B817A94E25EDDC5FC6C58C8322D56E330124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 5d6462d38e0302bc438956182201b912d227a33fcbe679623310b6ad57567863
MD5 3d4260109b0bb35439d4609d12b89d98
SHA1 ce75483e401f009fd0dfa767a9e0f2ed4856c4bd
SHA512 627ad4e92c35a2ab922a382618b4ea6d3aa9234b02d1b910e281cf46acb7e3b2277408f72e6b154658cd28bfcd6248222f49f8ed7d440b79954f93eff8868c0d
TLSH
T18531E0981E77E6430265D3CABE3BCB037B185995A1AD06523BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2280-8-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-7-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-11-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-12-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-13-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-14-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-9-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-18-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-1-0x00007FFA8B8DF000-0x00007FFA8B8E0000-memory.dmp

Download

memory/2280-10-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-25-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-6-0x0000014F8F5B0000-0x0000014F8F5D2000-memory.dmp

Download

memory/2280-33-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-3-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2280-2-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/2376-41-0x00000000003B0000-0x00000000003FE000-memory.dmp

Download

memory/5496-43-0x0000000000400000-0x0000000000446000-memory.dmp

Download