donutloader | 57330a90bd9dfa527a3bd5dd617414cce87017d09e6db32c53ef5a46736862eb

General

Target
21072026_1644_SystemSettings.exe.iso
Size 4.7MB
Sample260721-t811fa1ajf
SHA256 57330a90bd9dfa527a3bd5dd617414cce87017d09e6db32c53ef5a46736862eb
MD5 bca2b0488b8a1e75e68354cb63f10c9b
SHA1 d6317ce674909d70f46b44c4504d07a87a7f5415
SHA512 a4d627b2769270e15411cf9759588335ee09644c1f6e7db94ba8c577803ca434c6e3cf54b412a975d4a2fc46943b6c3b3783a176634220cce16c1e50d47a743f
SSDEEP 98304:6OTOdqPSDP7eaOd4eG0sR+nfhPFeGjVx2Sn4Ia6G3ZgxY1aQD0bG:PTIYSj7eJGevrnfhteGj7nva6+JY
TLSH
T1E53633C72EA87156E4211938782A563C9713BC2502656BCB732FF5292F333EA5E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SystemSettings.exe
- Size 95KB
- SHA256 d3a50d173af5b0fdd44cbfd7bf7c7471a3b8998eb45c9b49aa2f1c98c9d54ca9
- MD5 bf344c30eeb707bc671e3d1427c58fd7
- SHA1 7f1d5d723d8b911f10149de09de81a286af09a60
- SHA512 f83d74da3f027ce15bed4c6b461583707b4fc6b712fb6ea35344991ccc26d13aebdd81841e6a5be2cd48e834d58776d1c4272a2838cd13ea3a5c6a62129faf63
- SSDEEP 1536:b2RifH09UTamiVQSPyrNfFLerqomIcoKCE45nHQM7rJBP11zBW:b2RifH0KF8QIctoj91w
- TLSH
  T173A32AC1BEACBA04E47A19307AA1857D6973BE230F10D6EF2563F36D1975BC4AD34A01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

donutloader loader persistence
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1
- Target
  Uso_Exclusivo_Interno.pdf.lnk
- Size 1KB
- SHA256 9b9026cfe84b985450836a2088c62225fc1ab7b266e102a8d495b6338a45c07b
- MD5 306b1a51116835d85aa5c93b0c89a487
- SHA1 f3c722fdfdb98c0c08908e525abf13d25410f09f
- SHA512 9492835b9658aaaa8aef1b0d9c5c513622d2c354dd6571924a992866aec127408baaacd2588e9f9de141419d0ead1e558ad8a9e75cafdceaaed8b0c34fd7d6cd
- TLSH
  T1A531DD061AD50775E3B18A3294BB96226977BC85E9125F6D00E042881863A02A836F7B
- MD5 SHA1 SHA512 TLSH
Score

10^/10

execution donutloader loader persistence
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral2 behavioral3
- Target
  systemsettings.dll
- Size 104KB
- SHA256 8e702485ce297ca9a510aca1841d8e8a436c1c03e1564f005bfa3e8869edb5cd
- MD5 80d262968ea1c37598d52067f2927f58
- SHA1 63ba8e06ce74273fd42aa38d6bf6fb5011125238
- SHA512 8c429199d3dc37335a2a3c9ffd74faba072ed87a80b149781ee9e87df0a8418e64865b9dea63b30d2e701a33c59610c2c708e1cb2ff624d9a54368f522d85bd5
- SSDEEP 3072:6A/eyLKw7Iz9A5Lj1NMsLZ4Cv2GWwD80p5wCDvmXT7RLyzfWC7PlC2nrR+0q6G24:6szLxYkLj1GYRJG2z
- TLSH
  T1E8A3395B77B540BBE1778238C86B4A45DB72B8414760AFAF43A0465A2F233E19D3DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

donutloader loader persistence
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral4 behavioral5