donutloader | 47d0191c48766ba2a8a0dc0c76d2b461f5b4a008efe1f912555adcbd2313ee04

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice_Challan.bat
Size 2.4MB
Sample260730-k91avseh69
SHA256 47d0191c48766ba2a8a0dc0c76d2b461f5b4a008efe1f912555adcbd2313ee04
MD5 12645feea429c56e53af9827f88ca53a
SHA1 157e681b814abcbabf2fd7afaa30bc9c25fec5c0
SHA512 5d313b8f7154649083e1e91d7dc335185b385bcb0b547915da39def6e9e233737bd6945e78c8aba00915e3ee00db508f35ce452f4b97facb49ad0e18cba122d4
SSDEEP 24576:Zsz/d2DS7DUjs0xeumkOyk/G9NvP5NH7lO1LjQYNlAIK/vDmDyGdKDg7:fD/mAcOg7
TLSH
T1EAC59E0748E72A3DA7D4324D50BEE64F2E9011B7AECC146FDA2529697DBB94DC00F0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

gameofloveweb.duckdns.org:8800
gameoflovewb.gleeze.com:8800
91.92.42.65:8800

Mutex

2xyKkPt24UmnAIJR

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2160-36-0x0000000003390000-0x00000000033A0000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2160-34-0x00000000012B0000-0x00000000012C2000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
964	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2616	vijewyufveonabghulluonouceyasi.exe
1764	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GIFT DOKU = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	reg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4268	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1404	nslookup.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
964	powershell.exe
964	powershell.exe
1404	nslookup.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	2160	nslookup.exe
Token: SeDebugPrivilege	1404	nslookup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1404	nslookup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 964	1264	cmd.exe	89
PID 964 wrote to memory of 4268	964	powershell.exe	92
PID 964 wrote to memory of 2616	964	powershell.exe	93
PID 2616 wrote to memory of 2160	2616	vijewyufveonabghulluonouceyasi.exe	95
PID 2616 wrote to memory of 2160	2616	vijewyufveonabghulluonouceyasi.exe	95
PID 1764 wrote to memory of 1404	1764	vijewyufveonabghulluonouceyasi.exe	98
PID 1764 wrote to memory of 1404	1764	vijewyufveonabghulluonouceyasi.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Invoice_Challan.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w hidden -exec bypass -F "C:\Temp\update.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "GIFT DOKU" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4268
- - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
    "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\SysWOW64\nslookup.exe
      C:\Windows\Syswow64\nslookup.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2160

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\nslookup.exe
  C:\Windows\Syswow64\nslookup.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 69KB
SHA256 1b3b2ab2d5379bbe3105399a8f311ce73b0284aa3d4c04d8d8af70cd7b7caa61
MD5 dc6b50f3ffea5807a2c5dad06f22cbb0
SHA1 ef61d6199982f4a8b02c8ec57c812f9327d0bfd9
SHA512 4adbe1f527428322a61704d983f5439786a9b2ce5e39c81c65a61d05c9660dcbaa413de096b694085c2970d6f70675e997eb23178f4ee7c23470c553ff8a5003
SSDEEP 1536:EFSq2aR48gNeYgblN1oUlIAXWycVMwxFnPBGDj6UhEi+Li76MCfpy+eob6x+UBW:Ekq2fNeYg9TIHdZxZpGDj6Uhm+8xy+dV
TLSH
T1DC63E180D95718EE23B05D6EC76A2C7D0A7907A40B76D8D8CF67650CC3AFFA2671824D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 3KB
SHA256 3cc31a73ddcd1cc218cbbe78994aa65253e9da5edfeeb908587bf9b07e126ce4
MD5 09b4196f48e17edf7c03661aaf12c0f5
SHA1 09a01c759f875cca5a2243757bab3c67c2113b1f
SHA512 2a19d4af094a0ad434cfd85fb92c260017b8d681aaeb7b965bd997fae3f0c74833986a23723ab5d45c293a083464cfcb4c4fae2f9a2c00912e041d03b3050ce0
TLSH
T1F751E0C47C0FE5402CA8211A9D29CE6BF79EADAF053D01313E99C2959FAC7BCE048748
MD5 SHA1 SHA512 TLSH

Submit Download

memory/964-10-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-7-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-9-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-11-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-2-0x00007FFBCBD6F000-0x00007FFBCBD70000-memory.dmp

Download

memory/964-12-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-13-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-14-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-15-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-16-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-17-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-18-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-19-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-8-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-31-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-6-0x0000023BE08A0000-0x0000023BE08C2000-memory.dmp

Download

memory/964-33-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/964-3-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/1404-40-0x00000000053B0000-0x000000000596A000-memory.dmp

Download

memory/1404-41-0x0000000005100000-0x0000000005192000-memory.dmp

Download

memory/1404-42-0x00000000050F0000-0x00000000050FA000-memory.dmp

Download

memory/1404-43-0x0000000006CE0000-0x0000000006D46000-memory.dmp

Download

memory/2160-34-0x00000000012B0000-0x00000000012C2000-memory.dmp

Download

memory/2160-37-0x0000000005810000-0x00000000058AC000-memory.dmp

Download

memory/2160-36-0x0000000003390000-0x00000000033A0000-memory.dmp

Download