donutloader | 09a78d4ca618d275809fa2af5f6f1b9b40d5ed2e552ba6ff1ef66b59ccaa1531

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO NO. 2500510 COLORSTAR CHEMICAL INDUSTRIAL CORPORATION.bat
Size 1.2MB
Sample260713-qzcppscv7z
SHA256 09a78d4ca618d275809fa2af5f6f1b9b40d5ed2e552ba6ff1ef66b59ccaa1531
MD5 42d60e249dab73703bcd2935334f5cf3
SHA1 7f8f8efb940ccc5f70887a1d36598366a5d127ad
SHA512 60e9a4bb30aea5899ad9eb5874ace84bf6d0c7f017aabd8f093a541e33d864d9e997a2363d98e4c8a5a7a72bd4e28f314d2bd9f2a14e778efb0c01a02bd8a5a3
SSDEEP 24576:uARMo7aPyp5pBZWMbOMtsk1VdmvHS1c/7eq2CdUAS520vEtGzKwwkHLAZgmIjdJU:ywFEMiJ5fPppgHLAZII
TLSH
T1F04523A08D999CFB85ECA22DB84F8D1E8FF40635C047D0F762C0AC9E5AAAF5145474B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery donutloader formbook loader persistence rat spyware stealer trojan

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5040-34-0x0000000000B40000-0x0000000000B8E000-memory.dmp	family_donutloader

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/5040-38-0x0000000002B50000-0x0000000002B96000-memory.dmp	family_formbook
behavioral2/memory/3436-43-0x0000000001200000-0x0000000001244000-memory.dmp	family_formbook

Executes dropped EXE 2 IoCs

pid	Process
4292	vijewyufveonabghulluonouceyasi.exe
2488	vijewyufveonabghulluonouceyasi.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	SearchIndexer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 2896	5040	charmap.exe
PID 4684 set thread context of 2896	4684	charmap.exe
PID 4684 set thread context of 3436	4684	charmap.exe	96
PID 5040 set thread context of 3404	5040	charmap.exe	95
PID 3436 set thread context of 5224	3436	SearchIndexer.exe	81
PID 3436 set thread context of 1252	3436	SearchIndexer.exe	98

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchIndexer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3797332335-34111092-3597280141-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5480	powershell.exe
5480	powershell.exe
5040	charmap.exe
5040	charmap.exe
5040	charmap.exe
5040	charmap.exe
4684	charmap.exe
4684	charmap.exe
4684	charmap.exe
4684	charmap.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3404	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5224	explorer.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
5040	charmap.exe
4684	charmap.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe
3436	SearchIndexer.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe
Token: SeShutdownPrivilege	5224	explorer.exe
Token: SeCreatePagefilePrivilege	5224	explorer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 5480	5024	cmd.exe	88
PID 5480 wrote to memory of 4292	5480	powershell.exe	90
PID 4292 wrote to memory of 5040	4292	vijewyufveonabghulluonouceyasi.exe	93
PID 4292 wrote to memory of 5040	4292	vijewyufveonabghulluonouceyasi.exe	93
PID 2488 wrote to memory of 4684	2488	vijewyufveonabghulluonouceyasi.exe	94
PID 2488 wrote to memory of 4684	2488	vijewyufveonabghulluonouceyasi.exe	94
PID 3436 wrote to memory of 1252	3436	SearchIndexer.exe	98

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	SearchIndexer.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO NO. 2500510 COLORSTAR CHEMICAL INDUSTRIAL CORPORATION.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\Windows\SysWOW64\charmap.exe
        
        C:\Windows\Syswow64\charmap.exe
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:5040

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\charmap.exe
  C:\Windows\Syswow64\charmap.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4684

C:\Windows\SysWOW64\SearchIndexer.exe
"C:\Windows\SysWOW64\SearchIndexer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404

C:\Windows\SysWOW64\SearchIndexer.exe
"C:\Windows\SysWOW64\SearchIndexer.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:3436
- C:\Program Files\Mozilla Firefox\Firefox.exe
  "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2⤵
  PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 310KB
SHA256 7c4ac725e3acc9af51f91fea411f274c1ea4bde0cf92070068b6118133a6cb13
MD5 5ed615ab5e44e573e1b2eb81691d7d69
SHA1 f36fa5f091d4095c5c6854e9baf9fdf005fbecce
SHA512 aff75623f819b697c2f4a0e4a073b36ab4ff527e6ee723106240a523dca727cc01c756884b40ec6e14ff966fe37a42cbb8b36229fae7232a181cd327974628e5
SSDEEP 6144:15ISpQcomc1IrkaUAlk5Nd1PqdWce55fw1BhLxA/dSQODLMXivaUy+dV:jI+4mNpYN3Pq+OBidMwXAWWV
TLSH
T1976412A1902939D607A0EC6E96864D390B391B359F2ACD300F4BFF8D4337F979A86519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 dc993f148b69a661d0fab529381b5c19b1765c266bfcba4b56fa5bdb2a825f79
MD5 07e3775f3290d7edf427c3979dd998f4
SHA1 b13c00e0d176cc81729ed0e2ffde94541d21c339
SHA512 5fe43149ba787bbca10d9479d0782a1ad989c66f01abb7a6a1c18e0a3e1bcefadac110d7b706dd3efc9063680b4733a8ffed96bf284c929ca2e6623c2441dd8b
TLSH
T1663100981E77E6030365D3CABE3BCB037B180995A1AD06533BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1252-52-0x000002B86A900000-0x000002B86A9B0000-memory.dmp

Download

memory/3436-43-0x0000000001200000-0x0000000001244000-memory.dmp

Download

memory/3436-40-0x0000000001200000-0x0000000001244000-memory.dmp

Download

memory/5040-38-0x0000000002B50000-0x0000000002B96000-memory.dmp

Download

memory/5040-35-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/5040-34-0x0000000000B40000-0x0000000000B8E000-memory.dmp

Download

memory/5224-45-0x0000000004D60000-0x0000000004E14000-memory.dmp

Download

memory/5480-16-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-12-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-2-0x00007FFDAF6AF000-0x00007FFDAF6B0000-memory.dmp

Download

memory/5480-17-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-18-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-19-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-14-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-13-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-31-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-15-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-11-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-10-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-9-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-8-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-7-0x000001ED78BE0000-0x000001ED78C02000-memory.dmp

Download

memory/5480-6-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/5480-4-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download