donutloader | c84b27346b84457e3d760dc9db3bfb32830dffbbdd7740491cfe5be4dddc2b31

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HECFfn98j1.vbs
Size 1.2MB
Sample260710-exvxqaes5v
SHA256 c84b27346b84457e3d760dc9db3bfb32830dffbbdd7740491cfe5be4dddc2b31
MD5 c4fa39a17f0512fd83ac8d2a9bd398b0
SHA1 71a808650ae63d4cc658822e077e22d5ff058d7e
SHA512 0c4ed4f90f042da9e1e50145f128a718994d763ca93eba2ac90a19bdd34244e314039789746e16cd9bcec24028abe8f5bf4de36eac16b8388627eac4682c5728
SSDEEP 24576:00cOj1cR8v7rP7QiGem9wouCUBfgVXpbi31BK2NBnrc2k5jwvPH:0XOJTrjQFCFCUZmYH
TLSH
T1F2452341EF8F3E300FB4AA38B07E6F0D9F30CA9D9456F499127169831476BC153AE869
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/5064-46-0x0000000000180000-0x00000000001CE000-memory.dmp	family_donutloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2148	vijewyufveonabghulluonouceyasi.exe
3324	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
764	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
764	powershell.exe
764	powershell.exe
4260	powershell.exe
4260	powershell.exe
2920	charmap.exe
2920	charmap.exe
2920	charmap.exe
2920	charmap.exe
2920	charmap.exe
2920	charmap.exe
2920	charmap.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 764	4880	WScript.exe	86
PID 4880 wrote to memory of 956	4880	WScript.exe	88
PID 956 wrote to memory of 4260	956	cmd.exe	90
PID 4260 wrote to memory of 2148	4260	powershell.exe	92
PID 2148 wrote to memory of 5064	2148	vijewyufveonabghulluonouceyasi.exe	95
PID 2148 wrote to memory of 5064	2148	vijewyufveonabghulluonouceyasi.exe	95
PID 3324 wrote to memory of 2920	3324	vijewyufveonabghulluonouceyasi.exe	96
PID 3324 wrote to memory of 2920	3324	vijewyufveonabghulluonouceyasi.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HECFfn98j1.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp802956.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp802956.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp802956.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Windows\SysWOW64\charmap.exe
        
        C:\Windows\Syswow64\charmap.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5064

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\charmap.exe
  C:\Windows\Syswow64\charmap.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e490fcc2bdf5a050aa8bc34e8895b9ee480e63041ea1e7fef3d17f9a8da1aa58
MD5 82076fffcf155d65fb51603f133dc0c0
SHA1 4c159e2b76ab9018cbc554e93014f91fed675a79
SHA512 59b7ee703aa2d217467d470ffbf523c64e20ab08775328b0e6e362afae0618bf166dc4675b7699e154e361762eace811996f05ffe7744e045b8a4d6198ae65c3
TLSH
T1B0218627B39C8A21CC86163A109D9C1172B683C7809ECF9F6BC0D610A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vtelzyfp.r31.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vtelzyfp.r31.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp802956.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp802956.bat
Size 1.2MB
SHA256 ab54abb8b9840f2f90c0d0bacf79c73890b35274b81384cc3929c335d12f9fe7
MD5 bff7d309a379b2c17032a3b7ef7680f3
SHA1 2f64db17ba5d6a40731463e22dcd8b016737abc4
SHA512 0f48058de002c10ac3c7acb2e73efb98c6b4d00b3b3dff280fb02c7be1e42fa7fe930144bd261310610b929149a58fbffaf95c1942c34dd157ea0053df2e71bd
SSDEEP 24576:7S+2+phAOCaQga0L5TaXFftcuJNmK+k1NEkgfoVTi:GSph2Qe9fNnGo4
TLSH
T1D645335065D96EAFCD2CF23A619A3F186F784B23282479FB10F17D943C5EA4449CB12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp802956.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp802956.bat.gz
Size 933KB
SHA256 a0d445eaa1d3a246eac42e8d50f919e43ce46911aeea7a8ac90e7bb1376894a9
MD5 3899d0955493e20664bfede92b8f2269
SHA1 b0da9e0cf30966a60221c4f541161f8970f6d41c
SHA512 f74ac0ab627cbe652af1f729ff3e9759973f64b9302d36f3fe0a559fe904690de91d414458db874c5b08547aea2b140becd87164ad66f124a904139db074d9af
SSDEEP 12288:yCK5ix6fisVu+T1iDRKyK9WWJsCyVDpdhjeujfe0hROA0k9VjHNqfTvmHfGbJF47:yx5TisVB1AMFsCWt/FTeIOkTqK/GbJY
TLSH
T1CB15331291956F4F750EBCC804E83C16DC7960E2A56E70F8BAC5023A435FD670AB7BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 308KB
SHA256 b4597c2ff2a3fa9f09ec2496a0fe986db25bb4bab8193db37027784b44b15be0
MD5 0f95f6f80034de0b988af9f5d307f16c
SHA1 bf744e6aa3612a1dcb371344b5a7fb7429f8b4de
SHA512 fbef263af4293cefc3769f86663ba975ec9266bf89f9bb4e139ca67002af781e684b2aa71a2c5b70f5793f8545bc4402df97ea7036b5aa04097598bf97e7d400
SSDEEP 6144:NRqxIDTsuxXu1+lhWAa+Fan4TOzBxBOli8HE+HEmxbO/GaUy+dV:NRSIfsugME+UIozBOVHkmo+WWV
TLSH
T167641282C9942C6C39926C6BE7E72C7F477803154FB9CB889FF19C9D4B6AF5D2201819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 dc993f148b69a661d0fab529381b5c19b1765c266bfcba4b56fa5bdb2a825f79
MD5 07e3775f3290d7edf427c3979dd998f4
SHA1 b13c00e0d176cc81729ed0e2ffde94541d21c339
SHA512 5fe43149ba787bbca10d9479d0782a1ad989c66f01abb7a6a1c18e0a3e1bcefadac110d7b706dd3efc9063680b4733a8ffed96bf284c929ca2e6623c2441dd8b
TLSH
T1663100981E77E6030365D3CABE3BCB037B180995A1AD06533BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/764-5-0x000001F73B930000-0x000001F73B952000-memory.dmp

Download

memory/764-2-0x000001F7231C0000-0x000001F7231D0000-memory.dmp

Download

memory/764-1-0x000001F7231C0000-0x000001F7231D0000-memory.dmp

Download

memory/2920-49-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5064-46-0x0000000000180000-0x00000000001CE000-memory.dmp

Download