donutloader | 09a78d4ca618d275809fa2af5f6f1b9b40d5ed2e552ba6ff1ef66b59ccaa1531

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO NO. 2500510 COLORSTAR CHEMICAL INDUSTRIAL CORPORATION.bat
Size 1.2MB
Sample260713-qzcppscv7z
SHA256 09a78d4ca618d275809fa2af5f6f1b9b40d5ed2e552ba6ff1ef66b59ccaa1531
MD5 42d60e249dab73703bcd2935334f5cf3
SHA1 7f8f8efb940ccc5f70887a1d36598366a5d127ad
SHA512 60e9a4bb30aea5899ad9eb5874ace84bf6d0c7f017aabd8f093a541e33d864d9e997a2363d98e4c8a5a7a72bd4e28f314d2bd9f2a14e778efb0c01a02bd8a5a3
SSDEEP 24576:uARMo7aPyp5pBZWMbOMtsk1VdmvHS1c/7eq2CdUAS520vEtGzKwwkHLAZgmIjdJU:ywFEMiJ5fPppgHLAZII
TLSH
T1F04523A08D999CFB85ECA22DB84F8D1E8FF40635C047D0F762C0AC9E5AAAF5145474B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/3752-32-0x00000000001B0000-0x00000000001FE000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
4244	vijewyufveonabghulluonouceyasi.exe
1588	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5032	powershell.exe
5032	powershell.exe
3964	charmap.exe
3964	charmap.exe
3964	charmap.exe
3964	charmap.exe
3964	charmap.exe
3964	charmap.exe
3964	charmap.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 5032	3324	cmd.exe	89
PID 5032 wrote to memory of 4244	5032	powershell.exe	91
PID 4244 wrote to memory of 3752	4244	vijewyufveonabghulluonouceyasi.exe	94
PID 4244 wrote to memory of 3752	4244	vijewyufveonabghulluonouceyasi.exe	94
PID 1588 wrote to memory of 3964	1588	vijewyufveonabghulluonouceyasi.exe	95
PID 1588 wrote to memory of 3964	1588	vijewyufveonabghulluonouceyasi.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO NO. 2500510 COLORSTAR CHEMICAL INDUSTRIAL CORPORATION.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
    "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\SysWOW64\charmap.exe
      C:\Windows\Syswow64\charmap.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3752

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\charmap.exe
  C:\Windows\Syswow64\charmap.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ixv3ddpm.hm1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ixv3ddpm.hm1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aqxuklgowzoifs.ps1

Path C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1
Size 1.2MB
SHA256 09a78d4ca618d275809fa2af5f6f1b9b40d5ed2e552ba6ff1ef66b59ccaa1531
MD5 42d60e249dab73703bcd2935334f5cf3
SHA1 7f8f8efb940ccc5f70887a1d36598366a5d127ad
SHA512 60e9a4bb30aea5899ad9eb5874ace84bf6d0c7f017aabd8f093a541e33d864d9e997a2363d98e4c8a5a7a72bd4e28f314d2bd9f2a14e778efb0c01a02bd8a5a3
SSDEEP 24576:uARMo7aPyp5pBZWMbOMtsk1VdmvHS1c/7eq2CdUAS520vEtGzKwwkHLAZgmIjdJU:ywFEMiJ5fPppgHLAZII
TLSH
T1F04523A08D999CFB85ECA22DB84F8D1E8FF40635C047D0F762C0AC9E5AAAF5145474B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 310KB
SHA256 7c4ac725e3acc9af51f91fea411f274c1ea4bde0cf92070068b6118133a6cb13
MD5 5ed615ab5e44e573e1b2eb81691d7d69
SHA1 f36fa5f091d4095c5c6854e9baf9fdf005fbecce
SHA512 aff75623f819b697c2f4a0e4a073b36ab4ff527e6ee723106240a523dca727cc01c756884b40ec6e14ff966fe37a42cbb8b36229fae7232a181cd327974628e5
SSDEEP 6144:15ISpQcomc1IrkaUAlk5Nd1PqdWce55fw1BhLxA/dSQODLMXivaUy+dV:jI+4mNpYN3Pq+OBidMwXAWWV
TLSH
T1976412A1902939D607A0EC6E96864D390B391B359F2ACD300F4BFF8D4337F979A86519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 dc993f148b69a661d0fab529381b5c19b1765c266bfcba4b56fa5bdb2a825f79
MD5 07e3775f3290d7edf427c3979dd998f4
SHA1 b13c00e0d176cc81729ed0e2ffde94541d21c339
SHA512 5fe43149ba787bbca10d9479d0782a1ad989c66f01abb7a6a1c18e0a3e1bcefadac110d7b706dd3efc9063680b4733a8ffed96bf284c929ca2e6623c2441dd8b
TLSH
T1663100981E77E6030365D3CABE3BCB037B180995A1AD06533BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3752-32-0x00000000001B0000-0x00000000001FE000-memory.dmp

Download

memory/3964-35-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5032-5-0x000001C0FAA10000-0x000001C0FAA20000-memory.dmp

Download

memory/5032-4-0x000001C0FAA10000-0x000001C0FAA20000-memory.dmp

Download

memory/5032-11-0x000001C0FCA90000-0x000001C0FCAB2000-memory.dmp

Download