donutloader | 2880c19f853059bae15a838d1320f728d3f681ff8bdfe22d455bc0335d317c7f

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1024KB
Sample260725-vncmsascra
SHA256 2880c19f853059bae15a838d1320f728d3f681ff8bdfe22d455bc0335d317c7f
MD5 a5cd6f31554350d552c42dc0320c85cb
SHA1 2a67068602cd24a96338010fb040eccd08b60aa3
SHA512 fd1041f424dae761f88ed3ed0b40644d8dd2e774556407eb412ce23583953f3e0451da31144a98b4a4e6271bb89a432616cca7d681f8f5574dbf88f75040406d
SSDEEP 3072:P53+Z2c90aq86nJ4YvsaLuiv0SQyd9sODvm3klPnR8YQpl29p8:P53+Zz6JD0Gugdd9bvf/OC9p
TLSH
T1F8253A5BB3E930F9E137C27985924A05EB72B4354721ABEF0360576A1F632D48D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader remus_stealer loader spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://zelpx.garden:9895
http://fimmora.surf:6504
http://tzpx.courses:4437

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4324-42-0x0000022D4FC40000-0x0000022D4FC7F000-memory.dmp	family_donutloader

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	6128	file.exe

Executes dropped EXE 1 IoCs

pid	Process
4324	Service.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4704	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2508	WMIC.exe
2508	WMIC.exe
2508	WMIC.exe
2508	WMIC.exe
4324	Service.exe
4324	Service.exe
4324	Service.exe
4324	Service.exe
4324	Service.exe
4324	Service.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2508	WMIC.exe
Token: SeSecurityPrivilege	2508	WMIC.exe
Token: SeTakeOwnershipPrivilege	2508	WMIC.exe
Token: SeLoadDriverPrivilege	2508	WMIC.exe
Token: SeSystemProfilePrivilege	2508	WMIC.exe
Token: SeSystemtimePrivilege	2508	WMIC.exe
Token: SeProfSingleProcessPrivilege	2508	WMIC.exe
Token: SeIncBasePriorityPrivilege	2508	WMIC.exe
Token: SeCreatePagefilePrivilege	2508	WMIC.exe
Token: SeBackupPrivilege	2508	WMIC.exe
Token: SeRestorePrivilege	2508	WMIC.exe
Token: SeShutdownPrivilege	2508	WMIC.exe
Token: SeDebugPrivilege	2508	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2508	WMIC.exe
Token: SeRemoteShutdownPrivilege	2508	WMIC.exe
Token: SeUndockPrivilege	2508	WMIC.exe
Token: SeManageVolumePrivilege	2508	WMIC.exe
Token: 33	2508	WMIC.exe
Token: 34	2508	WMIC.exe
Token: 35	2508	WMIC.exe
Token: 36	2508	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2508	WMIC.exe
Token: SeSecurityPrivilege	2508	WMIC.exe
Token: SeTakeOwnershipPrivilege	2508	WMIC.exe
Token: SeLoadDriverPrivilege	2508	WMIC.exe
Token: SeSystemProfilePrivilege	2508	WMIC.exe
Token: SeSystemtimePrivilege	2508	WMIC.exe
Token: SeProfSingleProcessPrivilege	2508	WMIC.exe
Token: SeIncBasePriorityPrivilege	2508	WMIC.exe
Token: SeCreatePagefilePrivilege	2508	WMIC.exe
Token: SeBackupPrivilege	2508	WMIC.exe
Token: SeRestorePrivilege	2508	WMIC.exe
Token: SeShutdownPrivilege	2508	WMIC.exe
Token: SeDebugPrivilege	2508	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2508	WMIC.exe
Token: SeRemoteShutdownPrivilege	2508	WMIC.exe
Token: SeUndockPrivilege	2508	WMIC.exe
Token: SeManageVolumePrivilege	2508	WMIC.exe
Token: 33	2508	WMIC.exe
Token: 34	2508	WMIC.exe
Token: 35	2508	WMIC.exe
Token: 36	2508	WMIC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 4324	6128	file.exe	89
PID 4324 wrote to memory of 4704	4324	Service.exe	90
PID 4704 wrote to memory of 2508	4704	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Users\Admin\AppData\Local\dm4q3s\Service.exe
  "C:\Users\Admin\AppData\Local\dm4q3s\Service.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic os get name > nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get name
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

actami[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T62SOWKB\actami[1].exe
Size 284KB
SHA256 fa05d90b717904173938dc9c4ff6c32069e55b0c25ff147199d716840d87fb0c
MD5 abbcff9f2baa6c8568a7370449a1d626
SHA1 ac12d5be18e0450ab627f4b7d028496c04aafa26
SHA512 2e9a866bde624d6c098f3f9663c72d4e79d869e677a443df59b897fc5972941c99b38fa5da2eb43c7b7f5fc63006be274cf8191bc4c21347b72cb4230b08af8a
SSDEEP 3072:sy5ZnbqEfLe1rUVu3ciNxQ3Uh0sAz4EBDvusrCRJ5GVQjQSltq7r1DGSy+iP5/dX:WQ3zJz4EtuKk4SzgqVVxHwRU
TLSH
T13D547D59B7A518FAEE77C13CC9524605EA727C524760DACF03A04AA72F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4324-42-0x0000022D4FC40000-0x0000022D4FC7F000-memory.dmp

Download

memory/4324-43-0x0000022D4FCC0000-0x0000022D4FCFA000-memory.dmp

Download