donutloader | a03be075f7e2d5bcb20998b98e59fdab1ce4c959675a9b20076eb959189e2f93

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Purchase Order.js
Size 1.2MB
Sample260724-p3xcva1ake
SHA256 a03be075f7e2d5bcb20998b98e59fdab1ce4c959675a9b20076eb959189e2f93
MD5 b3a873f0b9fb29fccc23866807f602fa
SHA1 7cd98f6500919c6d5cf402b2db2839538d259570
SHA512 9db32624cb4eb0f37b672f2e66016bb6e1fa17d861f26159e152106a1641506bc6b3525ba6ed67dcf339ea3ef7a284c69b82bcdca49e1be1a3baba8b5ececfa5
SSDEEP 24576:9haw7jCKANf+gT8dxmdSakkLCsmhaDtE2rW90CVycsa1Al:94wHCiBcScDPWb15il
TLSH
T166453340AF198EBD03DCC3C8712B9DAD4F423E41E64994DBB2D3C9E7876A705C9AB494
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4900-39-0x0000000000EE0000-0x0000000000F2E000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
2724	vijewyufveonabghulluonouceyasi.exe
2424	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1764	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1764	powershell.exe
1764	powershell.exe
3100	powershell.exe
3100	powershell.exe
4900	msra.exe
4900	msra.exe
4900	msra.exe
4900	msra.exe
4900	msra.exe
4900	msra.exe
4900	msra.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 1764	5856	wscript.exe	89
PID 5856 wrote to memory of 5756	5856	wscript.exe	91
PID 5756 wrote to memory of 3100	5756	cmd.exe	93
PID 3100 wrote to memory of 2424	3100	powershell.exe	98
PID 2724 wrote to memory of 1048	2724	vijewyufveonabghulluonouceyasi.exe	99
PID 2424 wrote to memory of 4900	2424	vijewyufveonabghulluonouceyasi.exe	100
PID 2724 wrote to memory of 1048	2724	vijewyufveonabghulluonouceyasi.exe	99
PID 2424 wrote to memory of 4900	2424	vijewyufveonabghulluonouceyasi.exe	100
PID 4900 wrote to memory of 4144	4900	msra.exe	102
PID 1048 wrote to memory of 2140	1048	msra.exe	101

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\New Purchase Order.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp119794.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp119794.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp119794.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Windows\SysWOW64\msra.exe
        
        C:\Windows\Syswow64\msra.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4900
      - C:\Windows\system32\msra.exe
        
        "C:\Windows\system32\msra.exe"
        6⤵
        
        PID:4144

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\msra.exe
  C:\Windows\Syswow64\msra.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\msra.exe
    "C:\Windows\system32\msra.exe"
    3⤵
    PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

tmp119794.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp119794.bat
Size 1.2MB
SHA256 9518889ef04de50a8c47b1b36ecbe4f2c0c2e4f96b583d722b77ee002de16309
MD5 4528653180c70585859c5d08462deeb0
SHA1 df4ecf4436b898ff85e6c17ca0ebb50780647e99
SHA512 8e488db533900bd0f6d7f16b8ff2002764d42e6d643efb53cf067fb7f81f6b84ae810db83b9a539a782d75a704e71f1fabc44f3c30780e7261cc806dee333baa
SSDEEP 24576:04VQB90ToWgZl76vGCuvv5CeAkpYMHQvWWqyYPlhNT/gU/4s9:0Wa72ghbAknDlL8Ud9
TLSH
T15F4533616FD16D794C48D23B506F8B0EAF593A914C8A994357E984CF370BFA68A0F13C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp119794.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp119794.bat.gz
Size 933KB
SHA256 a1dfa53407c8eeac7f4d852c67b6497835e8e78547f295f71735e64aec10ac03
MD5 c41941c4d961d322159951eabbf95ef9
SHA1 8e11fc2fa00ebb7ab6db3508204cb0d4cd3ad1e0
SHA512 572e4f8cafb52547b3b4e500ed012386d5b72657596c77c8ad155a7bd2393e8c13016630c6f12b561957d33e567975757cf06c1fef84bc34a99b91e3c63ec9e5
SSDEEP 24576:BaQrcCuUY22GA0FD/aaRg3HIyVzZNzoTxKy3I7W:BaUT2sDBRKjWT8Y
TLSH
T174153368B45DF0D95A36600E3CE0A7B0D9A8FFD03909D66952536A33F8ECD06A19C53F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 308KB
SHA256 45debf7710447ac92a5f1ba06e06a0facf3731a8aae05c38ce8141781f09dee3
MD5 75f2492281d815344d7b8aab7288f053
SHA1 3c502b9a8695bcb216b1280b33f524704dafd505
SHA512 20e13aac5738af8133eb011636222f205f16b6ba669dfabdf324b82caee3830803922da376cb9f59c329cb35852ced72488c22e07aac7682b4926ed2263ef150
SSDEEP 6144:IwjaKLNsqw66m0hoy1eFLm5lV3AqYl/nndVylt1c3MdDzeaUy+dV:Raae1m0hcJEP3n6/nilI3YzeWWV
TLSH
T1D2641290568ABCEC73939CAFCB1A967F05363B348975E810DCD331A9D3A7BA51B44884
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 5d6462d38e0302bc438956182201b912d227a33fcbe679623310b6ad57567863
MD5 3d4260109b0bb35439d4609d12b89d98
SHA1 ce75483e401f009fd0dfa767a9e0f2ed4856c4bd
SHA512 627ad4e92c35a2ab922a382618b4ea6d3aa9234b02d1b910e281cf46acb7e3b2277408f72e6b154658cd28bfcd6248222f49f8ed7d440b79954f93eff8868c0d
TLSH
T18531E0981E77E6430265D3CABE3BCB037B185995A1AD06523BD30A602914E5DFC8678B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1764-7-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-18-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-11-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-9-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-13-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-15-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-17-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-10-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-1-0x00007FFBDB51F000-0x00007FFBDB520000-memory.dmp

Download

memory/1764-8-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-6-0x000002A630B30000-0x000002A630B52000-memory.dmp

Download

memory/1764-3-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/1764-2-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp

Download

memory/4900-39-0x0000000000EE0000-0x0000000000F2E000-memory.dmp

Download

memory/4900-41-0x0000000000400000-0x0000000000446000-memory.dmp

Download