donutloader | e48e30950f0fb1729cc146e482716de25da2668db4661f9878f356a2575340d7

Analysis

max time kernel
300s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GD2212884 Offer & Next Steps.js
Size 1.2MB
Sample260714-bte6bab19l
SHA256 e48e30950f0fb1729cc146e482716de25da2668db4661f9878f356a2575340d7
MD5 b293394eb739a8dc01392d5430ceea3d
SHA1 9c1f5aca61a670bca0917aff5182d7fcf1072905
SHA512 19db393f582fa638412316eb29e6aa3f3d63f9ade5b16e7ad116640e9772b8944d14e24fc7665447dbe27284548d29c01537176138333e420f2f86d07b626f37
SSDEEP 24576:H7PVeAI8HEuEhyQEyCBVqIhEvi4rBtMFSH20Do8ioF9bn+rtBiD/0qfQtQvNT:Hp/CA3qqEqeAe2voD+rPtEt
TLSH
T1E24523604D68BDB80279DB3A303F19595BD40FD8F45ED6EBC6A110D33267F01A4AB83A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/568-33-0x0000000000320000-0x000000000036E000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
3556	vijewyufveonabghulluonouceyasi.exe
2528	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dXcUlxyA = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3744	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3748	568	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3744	powershell.exe
3744	powershell.exe
1444	powershell.exe
1444	powershell.exe
4164	msra.exe
4164	msra.exe
4164	msra.exe
4164	msra.exe
4164	msra.exe
4164	msra.exe
4164	msra.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 3744	5008	wscript.exe	86
PID 5008 wrote to memory of 4788	5008	wscript.exe	88
PID 4788 wrote to memory of 1444	4788	cmd.exe	90
PID 1444 wrote to memory of 3556	1444	powershell.exe	92
PID 3556 wrote to memory of 568	3556	vijewyufveonabghulluonouceyasi.exe	95
PID 3556 wrote to memory of 568	3556	vijewyufveonabghulluonouceyasi.exe	95
PID 2528 wrote to memory of 4164	2528	vijewyufveonabghulluonouceyasi.exe	97
PID 2528 wrote to memory of 4164	2528	vijewyufveonabghulluonouceyasi.exe	97
PID 4164 wrote to memory of 4780	4164	msra.exe	100

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\GD2212884 Offer & Next Steps.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp663617.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp663617.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp663617.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Windows\SysWOW64\msra.exe
        
        C:\Windows\Syswow64\msra.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:568
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 88
        6⤵
        Program crash
        
        PID:3748

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\msra.exe
  C:\Windows\Syswow64\msra.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\msra.exe
    "C:\Windows\system32\msra.exe"
    3⤵
    PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 568 -ip 568
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

tmp663617.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp663617.bat
Size 1.2MB
SHA256 5d04c889c6c7f1f55bd72ceed0dd7024fb4fb29da84e8ff9861e0500a2dcee43
MD5 fb0e46c303cc1b28b7beee926794c3b6
SHA1 e32f087ffb1a81f6af134871e250c6b09014c4ab
SHA512 6f449b35cc39114298976dea586c226ffdd52ff79a5736c89e76e16681fdfe352c7394e256c68cc054f5b4e8acea69abc1cb9a2ce67073c40c981b4994df2eb7
SSDEEP 24576:TNbfZGmvnvzFieyUUdct80LUaR0VBL7mpE2l90IzFCmMs70EFWJHe5:TxfIHkUokayIDbAEAe5
TLSH
T1154533012CA9EDFB8868B311B14BCF462A940BD4A00AF5939FF5378539CB76456DF826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp663617.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp663617.bat.gz
Size 933KB
SHA256 14105e6787e57d4123608d53bffa68e228503f156920b916c2aea6ed5df032f0
MD5 1331e22d51e945520d014b39b806bd43
SHA1 e7d5fe0ec87f4862508fef8c86bcdc47903436cc
SHA512 968dcee0366e80f148756cbfab7e8f154a754a52242fe5fa7051e55b586b3dfbc1e3e3ba3b68453e1e80ce1a8017a33a2e2a053f3e313b555c61e101ebc27591
SSDEEP 24576:65JA/QeTTAw0/aebSClY8YEzFYF85LuiOvo/TmLSV65PRybjA0:Yvw0/PlY8TzSFaHOv9LbPRybM0
TLSH
T1B115334D7B1155817CD745EA9DF40A849902EC43A06A28B1C06CE9D267EBEE7133FECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 308KB
SHA256 4a9b7a50f15ea972b10ba7243b10173e98dbd1c642dc99a0a917ab9baa493344
MD5 b692fae01011316c4ae43a397336358b
SHA1 5619ec6837e48620f54bdced3a7ca9b306ff24e1
SHA512 0e0b2121fea84b16dcdb56143dbaefb2bbb6715c493891f394a00cd0fd177d73f4674fca8c70a6b67d4a26cf27b9a0e678d04dedd3c6cbe1fb68daa3da79a2b6
SSDEEP 6144:39WnipLamJUGuZYwI5v+w4WOEPpcBf3TO9ed5N7GafC6HGutM/aUy+dV:NWnBXIJxyBDO0d58sGutYWWV
TLSH
T1F76412C5A9C70CDF6FB4DE5BC74A09FECC751B6C01B9CC248A616464CB269173B292CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 5d6462d38e0302bc438956182201b912d227a33fcbe679623310b6ad57567863
MD5 3d4260109b0bb35439d4609d12b89d98
SHA1 ce75483e401f009fd0dfa767a9e0f2ed4856c4bd
SHA512 627ad4e92c35a2ab922a382618b4ea6d3aa9234b02d1b910e281cf46acb7e3b2277408f72e6b154658cd28bfcd6248222f49f8ed7d440b79954f93eff8868c0d
TLSH
T18531E0981E77E6430265D3CABE3BCB037B185995A1AD06523BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/568-33-0x0000000000320000-0x000000000036E000-memory.dmp

Download

memory/3744-7-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3744-12-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3744-13-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3744-8-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3744-1-0x00007FFD2973F000-0x00007FFD29740000-memory.dmp

Download

memory/3744-6-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3744-5-0x000001AEEE120000-0x000001AEEE142000-memory.dmp

Download

memory/3744-4-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/4164-36-0x0000000000400000-0x0000000000446000-memory.dmp

Download