donutloader | 96b747a94a2007c42913189440a8a3014f574d134148017cb2cebef4c66520ca

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REMMITTANCE RETR SCS2208023.vbs
Size 5.2MB
Sample260724-geavyaef35
SHA256 96b747a94a2007c42913189440a8a3014f574d134148017cb2cebef4c66520ca
MD5 403703d0c7857a87c6b3dc7021c03494
SHA1 090f00a61ea249d80e052813ab9a945eae2683d4
SHA512 4c01e2a207b0d39df925f377ac75cff491ecb02d6fca54fc17e1c747916d6760b8026d054507aa6716c57149cc71477acf48c6f9e7202eeb4a61e92c563f1445
SSDEEP 24576:8JWJZFOgt5F22LKV/5GyXh5JI7MOK0XiENyHeX4kqN09u2TXzVpeO9765ZaL47HI:CzH+D931
TLSH
T131469F606E5859F5EF8C290E90AE6F1D87F082176A33706BFB41DF05BDDA241864B21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader vipkeylogger keylogger loader persistence stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
cphost17.qhoster.net
Port
587
Username
[email protected]
Password
Qwerty!@#
Email to
[email protected]

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4664-37-0x0000000000BA0000-0x0000000000BEF000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
3576	vijewyufveonabghulluonouceyasi.exe
4092	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
124	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3524	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4608	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	4664	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1536	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
124	powershell.exe
124	powershell.exe
5856	powershell.exe
5856	powershell.exe
4664	charmap.exe
1964	charmap.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	124	powershell.exe
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeDebugPrivilege	1964	charmap.exe
Token: SeDebugPrivilege	4664	charmap.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 124	3524	WScript.exe	89
PID 3524 wrote to memory of 4608	3524	WScript.exe	91
PID 4608 wrote to memory of 5856	4608	cmd.exe	93
PID 5856 wrote to memory of 1536	5856	powershell.exe	95
PID 5856 wrote to memory of 3576	5856	powershell.exe	98
PID 4092 wrote to memory of 4664	4092	vijewyufveonabghulluonouceyasi.exe	100
PID 3576 wrote to memory of 1964	3576	vijewyufveonabghulluonouceyasi.exe	99
PID 4092 wrote to memory of 4664	4092	vijewyufveonabghulluonouceyasi.exe	100
PID 3576 wrote to memory of 1964	3576	vijewyufveonabghulluonouceyasi.exe	99

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\REMMITTANCE RETR SCS2208023.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$b64=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\tmp894267.b64');$raw=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b64));[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\tmp894267.bat',[Convert]::FromBase64String($raw));Remove-Item 'C:\Users\Admin\AppData\Local\Temp\tmp894267.b64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp894267.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Windows32 /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1536
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Windows\SysWOW64\charmap.exe
        
        C:\Windows\Syswow64\charmap.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\charmap.exe
  C:\Windows\Syswow64\charmap.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 236
    3⤵
    - Program crash
    PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4664 -ip 4664
1⤵
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

tmp894267.b64

Path C:\Users\Admin\AppData\Local\Temp\tmp894267.b64
Size 10.5MB
SHA256 9c4e1e6791f302c04fde20d66cf207840d4e79e937379cad0ad376c4dbedb34c
MD5 8bf71b43af12c7160c42af2f54e72efe
SHA1 cadaeabe2f623f57af52edf5f926b0d92d1c5d76
SHA512 38400c61e764c797ecaab443c6d71a1f7484886948d4784c1d7c183349cbc174ccaccfdfadc0674b21ea5e5bf95fa74ec53522ee39a5295f2d56568ec873c679
SSDEEP 24576:aI59SVb5D2EL1S78YLcqnhy9+JFoNE1dGAcw+/MJLGmUe63XKazF3TeqC6HWpYIm:g
TLSH
T1F8B64438B9BB51495837FF523EECB9EADCDE1B226945541B1041070BDA22AD0EF2387D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp894267.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp894267.bat
Size 2.9MB
SHA256 ee8be5c8b869fb24a55001a294e4514d37753d851cddec9264ff6611ce8eddc7
MD5 1fa1e91f31242082a312e8126d6c3883
SHA1 890a25f80300411fd1dc4f166a18725647ff5467
SHA512 a8372b12fe4680e25c3bb4154426abe7e2e2e81232c304c8c169927b560f4b97abd9a715b7180d816778df71dea0bb8f9cc1a971a85828357c142e444118abdf
SSDEEP 24576:isIfXT+wnoWBMTG1sc+s/0a1oAFwSXvwdSy/LR0dWg28VvX/WvgcyAqUtOGffU9O:qawnrGSkgPvRoDwO
TLSH
T13CE5AF078CE61A3D97D8320D50BEE60F1F9051B7AA9C146FDA253A697EB794CC00F1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 313KB
SHA256 dd41d1b322e68f8a7d3bc0e73a7fd78954843322c7e2932f8de2cfb370d75cb0
MD5 c7a55db680ed5cd2b444699221525b3d
SHA1 ecb526b8094175e2ebb139d8e5fbf9e181ec1464
SHA512 7743c85c4938680ea90881bfd32a43cdf38c3d7f950cc6b1fcbbb0e0e5516efb55d0efa1828ba2a5e53ec44ab848eb98375d987ab5ea6f09b269817147bca886
SSDEEP 6144:AzsQ66hf5uFVR7np+ABauhpv4Yv/oSlaGDbBgq6DYquXbYBGcaUy+dV:Az/6o52hpTv/oOn7fkBGcWWV
TLSH
T15B6423509DA7689D3731CE8ED62F2D7B0778072A06BC9AE04EB208D753E3747B94E904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 dc993f148b69a661d0fab529381b5c19b1765c266bfcba4b56fa5bdb2a825f79
MD5 07e3775f3290d7edf427c3979dd998f4
SHA1 b13c00e0d176cc81729ed0e2ffde94541d21c339
SHA512 5fe43149ba787bbca10d9479d0782a1ad989c66f01abb7a6a1c18e0a3e1bcefadac110d7b706dd3efc9063680b4733a8ffed96bf284c929ca2e6623c2441dd8b
TLSH
T1663100981E77E6030365D3CABE3BCB037B180995A1AD06533BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-8-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/124-7-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/124-11-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/124-13-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/124-16-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/124-15-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/124-1-0x00007FFA936DF000-0x00007FFA936E0000-memory.dmp

Download

memory/124-9-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/124-6-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/124-2-0x0000022DC8C60000-0x0000022DC8C82000-memory.dmp

Download

memory/124-3-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/1964-39-0x0000000007EF0000-0x0000000007F3E000-memory.dmp

Download

memory/1964-40-0x0000000008690000-0x0000000008C4A000-memory.dmp

Download

memory/1964-41-0x0000000008180000-0x000000000821C000-memory.dmp

Download

memory/4664-37-0x0000000000BA0000-0x0000000000BEF000-memory.dmp

Download