donutloader | e48e30950f0fb1729cc146e482716de25da2668db4661f9878f356a2575340d7

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GD2212884 Offer & Next Steps.js
Size 1.2MB
Sample260709-kgb3kaf16w
SHA256 e48e30950f0fb1729cc146e482716de25da2668db4661f9878f356a2575340d7
MD5 b293394eb739a8dc01392d5430ceea3d
SHA1 9c1f5aca61a670bca0917aff5182d7fcf1072905
SHA512 19db393f582fa638412316eb29e6aa3f3d63f9ade5b16e7ad116640e9772b8944d14e24fc7665447dbe27284548d29c01537176138333e420f2f86d07b626f37
SSDEEP 24576:H7PVeAI8HEuEhyQEyCBVqIhEvi4rBtMFSH20Do8ioF9bn+rtBiD/0qfQtQvNT:Hp/CA3qqEqeAe2voD+rPtEt
TLSH
T1E24523604D68BDB80279DB3A303F19595BD40FD8F45ED6EBC6A110D33267F01A4AB83A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2256-39-0x00000000006F0000-0x000000000073E000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
4264	vijewyufveonabghulluonouceyasi.exe
5112	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Windows\CurrentVersion\Run\HNDkfZWE = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
792	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3500	6116	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
792	powershell.exe
792	powershell.exe
1136	powershell.exe
1136	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 792	960	wscript.exe	88
PID 960 wrote to memory of 1632	960	wscript.exe	90
PID 1632 wrote to memory of 1136	1632	cmd.exe	92
PID 1136 wrote to memory of 4264	1136	powershell.exe	94
PID 4264 wrote to memory of 2256	4264	vijewyufveonabghulluonouceyasi.exe	97
PID 4264 wrote to memory of 2256	4264	vijewyufveonabghulluonouceyasi.exe	97
PID 2256 wrote to memory of 2124	2256	msra.exe	98
PID 5112 wrote to memory of 6116	5112	vijewyufveonabghulluonouceyasi.exe	99
PID 5112 wrote to memory of 6116	5112	vijewyufveonabghulluonouceyasi.exe	99

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\GD2212884 Offer & Next Steps.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp423031.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp423031.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp423031.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\Windows\SysWOW64\msra.exe
        
        C:\Windows\Syswow64\msra.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2256
      - C:\Windows\system32\msra.exe
        
        "C:\Windows\system32\msra.exe"
        6⤵
        
        PID:2124

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\msra.exe
  C:\Windows\Syswow64\msra.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6116 -s 92
    3⤵
    - Program crash
    PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6116 -ip 6116
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d1365a82deeaeceef7153307d6caf6061994a45d1c4cce0b036a3ef8ac4312b0
MD5 5e390a37bb3f029e3be8e4b8655a097f
SHA1 f3e31d634881bf89623fcd168235e0b4e1fa4ed2
SHA512 18ab04ec0a2409cbd1adcc3527c291d197a5c382669facfa4d820f0cb9705eb51f8efe0587a753bdbbaf048f6fdc0f32307972e00de495f6d125b932fc92cd00
TLSH
T15C217F37B3DC8724DC9A413A50CEAC1036B6C7D7409ECF6B7B84D544B42F599DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

tmp423031.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp423031.bat
Size 1.2MB
SHA256 5d04c889c6c7f1f55bd72ceed0dd7024fb4fb29da84e8ff9861e0500a2dcee43
MD5 fb0e46c303cc1b28b7beee926794c3b6
SHA1 e32f087ffb1a81f6af134871e250c6b09014c4ab
SHA512 6f449b35cc39114298976dea586c226ffdd52ff79a5736c89e76e16681fdfe352c7394e256c68cc054f5b4e8acea69abc1cb9a2ce67073c40c981b4994df2eb7
SSDEEP 24576:TNbfZGmvnvzFieyUUdct80LUaR0VBL7mpE2l90IzFCmMs70EFWJHe5:TxfIHkUokayIDbAEAe5
TLSH
T1154533012CA9EDFB8868B311B14BCF462A940BD4A00AF5939FF5378539CB76456DF826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp423031.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp423031.bat.gz
Size 933KB
SHA256 14105e6787e57d4123608d53bffa68e228503f156920b916c2aea6ed5df032f0
MD5 1331e22d51e945520d014b39b806bd43
SHA1 e7d5fe0ec87f4862508fef8c86bcdc47903436cc
SHA512 968dcee0366e80f148756cbfab7e8f154a754a52242fe5fa7051e55b586b3dfbc1e3e3ba3b68453e1e80ce1a8017a33a2e2a053f3e313b555c61e101ebc27591
SSDEEP 24576:65JA/QeTTAw0/aebSClY8YEzFYF85LuiOvo/TmLSV65PRybjA0:Yvw0/PlY8TzSFaHOv9LbPRybM0
TLSH
T1B115334D7B1155817CD745EA9DF40A849902EC43A06A28B1C06CE9D267EBEE7133FECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 308KB
SHA256 4a9b7a50f15ea972b10ba7243b10173e98dbd1c642dc99a0a917ab9baa493344
MD5 b692fae01011316c4ae43a397336358b
SHA1 5619ec6837e48620f54bdced3a7ca9b306ff24e1
SHA512 0e0b2121fea84b16dcdb56143dbaefb2bbb6715c493891f394a00cd0fd177d73f4674fca8c70a6b67d4a26cf27b9a0e678d04dedd3c6cbe1fb68daa3da79a2b6
SSDEEP 6144:39WnipLamJUGuZYwI5v+w4WOEPpcBf3TO9ed5N7GafC6HGutM/aUy+dV:NWnBXIJxyBDO0d58sGutYWWV
TLSH
T1F76412C5A9C70CDF6FB4DE5BC74A09FECC751B6C01B9CC248A616464CB269173B292CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 5d6462d38e0302bc438956182201b912d227a33fcbe679623310b6ad57567863
MD5 3d4260109b0bb35439d4609d12b89d98
SHA1 ce75483e401f009fd0dfa767a9e0f2ed4856c4bd
SHA512 627ad4e92c35a2ab922a382618b4ea6d3aa9234b02d1b910e281cf46acb7e3b2277408f72e6b154658cd28bfcd6248222f49f8ed7d440b79954f93eff8868c0d
TLSH
T18531E0981E77E6430265D3CABE3BCB037B185995A1AD06523BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/792-8-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-9-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-11-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-12-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-13-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-15-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-14-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-10-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-19-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-1-0x00007FFF03EAF000-0x00007FFF03EB0000-memory.dmp

Download

memory/792-7-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-6-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/792-5-0x0000021824920000-0x0000021824942000-memory.dmp

Download

memory/792-2-0x00007FFF03D20000-0x00007FFF046C4000-memory.dmp

Download

memory/2256-39-0x00000000006F0000-0x000000000073E000-memory.dmp

Download