donutloader | 5478d1fe4f979f6a9a456d50dd84d18b04294701c9128eabcef412f6779a39b4

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deploy_wl1nue.bat
Size 531KB
Sample260730-hfzfcssepd
SHA256 5478d1fe4f979f6a9a456d50dd84d18b04294701c9128eabcef412f6779a39b4
MD5 56a3c6f776e56c6d9a9dc01a1c9bec16
SHA1 a2c6ac0f399b0972d6d4e0d67989aafaa761bbfb
SHA512 03d924c851f713a9a9e32f719593043aca9f4a223ed33dfa26be3b100303ad74db24b45322a669f7516d62d85f3ea8760f4067a1adad800d471e0b2efcea3985
SSDEEP 6144:L2ylJkG/cSx0WYotv7bTq3S+H8cl+uwRy3K0e+cJaYiWSu7BSbDvrzvAboWyZHgW:LJbkecSx0WYUnuTgRx0eriWT79oDuyd
TLSH
T1C8C4347E3F0655AA3C6A5499CE3DA95C3C5FF4870BB4CC08A583F23126894C8BB1D65E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/1876-2527-0x0000000003A30000-0x0000000003A89000-memory.dmp	family_donutloader

Loads dropped DLL 1 IoCs

pid	Process
3116	rundll32.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1420	certutil.exe
1772	certutil.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4348	cmd.exe
4504	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2924	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2924	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3116	rundll32.exe
3116	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1876	explorer.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1876	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4504	4348	cmd.exe	90
PID 4504 wrote to memory of 1420	4504	cmd.exe	92
PID 4504 wrote to memory of 1772	4504	cmd.exe	93
PID 4504 wrote to memory of 3116	4504	cmd.exe	94
PID 4504 wrote to memory of 2924	4504	cmd.exe	95
PID 3116 wrote to memory of 1876	3116	rundll32.exe	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deploy_wl1nue.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\deploy_wl1nue.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\hcfmh.b64" "C:\Users\Admin\AppData\Local\Temp\msupdate_wl1nue.dll"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:1420
  - - C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\cbofj.b64" "C:\Users\Admin\AppData\Local\Temp\own.enc"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:1772
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\msupdate_wl1nue.dll",Run
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3116
  - - C:\Windows\system32\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cbofj.b64

Path C:\Users\Admin\AppData\Local\Temp\cbofj.b64
Size 4KB
SHA256 dd44e5e862cf2d736e7b12325c417ac534c86e58e3e94780802595f07d157c46
MD5 7e2d220cd4628dfb2e46cfaf9feba07e
SHA1 69a1a9bcfd0402222036bf805ea1a8dfc8917bd2
SHA512 9347a5b08ede1c02397600e5272798cdcc7d5fb0e5890c30bb6f6ead042a0ef3faa8c28eaf12216abc35bb539a0ad69fb86fa9bc661e793466549b1a3c83bfbb
SSDEEP 96:Lrb+/Um7K+WEJK9ESv0zfZ9xcqlPf1o8iTOQIKvobhnFacHwNWAD8RJ:HbCdgEJzSv0h9xcqlPLiTiLdHRoKJ
TLSH
T17DA17E91967B052DB9D9C62C1B5631A38191F96D4D301D44370D423AABEE4F96BFF2C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbofj.b64

Path C:\Users\Admin\AppData\Local\Temp\cbofj.b64
Size 476KB
SHA256 22c6e514c6cfa48ee94100d17076b861b63e2ebbecdbc1500d65d52527f8b97c
MD5 906fe2d510a6283146b8112766cc791c
SHA1 dc4d62639feb31c5c86d5b3195e633b364656083
SHA512 83e514299b633909b7a51e3331682f8f9de9278e564cfa07e5e38585c467de3621f49b3557e920755991e66f993002c0e5dbea37a9772bfcad9fb1b82af46931
SSDEEP 6144:PKO+Di075SUm0ceXKQO1v63fMsVWNrhxx2EeirqegaWLTuwKKSvHPXU1bNiTpOjw:Pf+DN75SUm0/vGiZCxEEenaWfuwtND6J
TLSH
T155A423B3691BC6FF05A3B1BEB037AF6824D1A7C84C04621E93C023553BDE4979652AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcfmh.b64

Path C:\Users\Admin\AppData\Local\Temp\hcfmh.b64
Size 4KB
SHA256 fdc033e0f0124fbdae02006625eec0b03658d461a5433f8527ea114a598fea95
MD5 176340071094a6bde1c77099ff849c5f
SHA1 efd0d2b95ef526153a7dd143d99f8f71be089519
SHA512 efa045f5e36e234187379e8431a1b1c737774f73535998907b5156914654c912a917b5c69179cc5243da3ffe9b7dfddbdadd55301bee0803a97d3c5f591ebabd
SSDEEP 96:LrDjaD6YQxuW3YCa7O9WiGWPYW+Z66lsdBrFbWPB6I0pSOlwUke:HDtueYCxWiZSZfQL6GSOlw6
TLSH
T148A1A6BB445B7CDD7B786CD8980822C94C8C2D870329D186FE8870AB77E6056EDA59F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcfmh.b64

Path C:\Users\Admin\AppData\Local\Temp\hcfmh.b64
Size 19KB
SHA256 806fe129419114a839a33663e2297716ba52975caabdc1f0476b9a821ba4bd49
MD5 9d2a16def1c088c901e4d1e7bc370b46
SHA1 947f94e7794deaf448f10f2d5f2bdd6c92a08fd8
SHA512 e14d2a1246212b038b49d38c6e1438dd4eed8abdd7db08527dd660df856d0476b346dfbb9961e0a7b6b02b3e774c29470019259fe3dc4b38c0bea37369b7f619
SSDEEP 384:HcrCxWeS2xlwWmsuyoUTfq9SZjWmjiSB6DvF:82WeS2nm0XZjWmjiSB6p
TLSH
T1F092087A09577EDA2FB91CC858042881CC587EC76329C042FDC8305A9BF7469DD65AF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msupdate_wl1nue.dll

Path C:\Users\Admin\AppData\Local\Temp\msupdate_wl1nue.dll
Size 14KB
SHA256 1382fbfcc7691d404b2202838270efd4137d4a4964047b94f2ed1dfabb407741
MD5 72b7100b07cddd7fd67c694717f6c73a
SHA1 0f2a25189744a8c95159c6730def976d0e325225
SHA512 4ed6cea15a498b81f826bf3e58aa0269c2f7a2eb7d53ab0660c8d6ffc25549ef29f3ce066384455baddbf057a5e635bc72cd63765af2f06b8276a267f2b9f7b7
SSDEEP 96:juEtq/3VEgUdpvNF6P0z59VFaA2g4/JAFsWIycj17GBbqPe1ZHexEAheHSb1fDS0:KEtSFEfdjKuMAFP81Ks21ZHeXeFd4L
TLSH
T12362B80F32175899C50AC47941EB8B79BAF1B811C9E79B384334DA363E507A57A2AF44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

own.enc

Path C:\Users\Admin\AppData\Local\Temp\own.enc
Size 353KB
SHA256 a24730b62777b46bf22b83c08d470b9a85e22dccebf23635de2ca8cb72267325
MD5 27ab3c944cd89e0ec0e936950bdd3e3c
SHA1 c0f76c213efdcf013b9f19354537a8db8f5221cb
SHA512 201e743acb21503420add56313907676be98e801ff5154c67e9e70d88febb824e34939a5a955169ba09ca8d7f3dd3c19b4d59ce1c677e04ab85f6d105c65dba8
SSDEEP 6144:F/achICIw0Qrq39j0N2KRRajPrfmbGJFia+NN1PROI/3YQU:F7jQj0N2VFi/TPx/3TU
TLSH
T1107423B73CE50ED900BAB55A63A1C48A56DCFB4A670B385E061776C20950EACFB707C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1876-2527-0x0000000003A30000-0x0000000003A89000-memory.dmp

Download

memory/1876-2529-0x0000000008510000-0x0000000008568000-memory.dmp

Download

memory/1876-2530-0x0000000009260000-0x0000000009326000-memory.dmp

Download

memory/3116-2531-0x00007FFECD520000-0x00007FFECD52D000-memory.dmp

Download