donutloader | 46e22c3febad57d20dfb3b3a349ed43570794edc7a5f80008c3dc5970d84c3b9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
202607303544.exe
Size 6.3MB
Sample260731-gvbgeabl8s
SHA256 46e22c3febad57d20dfb3b3a349ed43570794edc7a5f80008c3dc5970d84c3b9
MD5 5f37017ca5051bc6df07f398b59f2e50
SHA1 3f7a740d898a7d4878afcab409a09eefcc55da0b
SHA512 dd1345fea101b9f3456040fe7b801ee249a92dea8650d7a5809d77fafa90a49d698fad4dc5874af78103ba1488fa96a6ca0806de33699965d8b5cbc0c4a99e55
SSDEEP 98304:y5tpLkt6IPYonsoseROg7OcqV0yExvfUJSAjk/PTiJay9tc08gsM+cZs:ym5YonsCqdVu9cJSAjkGcq+cZ
TLSH
T1AD66332321885084F3A463348576D569DAB1BC617BA547CF87043ABA1F3BBE79C3B319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4756-1-0x0000023A23F90000-0x0000023A2459F000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
4588	202607303544.exe

Loads dropped DLL 2 IoCs

pid	Process
4588	202607303544.exe
4588	202607303544.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate_t0ma = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_t0magwpk\\202607303544.exe"	202607303544.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate_t0ma = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_t0magwpk\\202607303544.exe"	202607303544.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	api.ipify.org
12	api.ipify.org
39	api.ipify.org
80	api.ipify.org

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DFF700E8-A357-4130-9EF3-5618A5A9A361}	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{3C45B753-44C8-499A-BAB5-1FD189127741}	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DF46660A-89ED-4DCC-AC3B-09F4AEE916EC}	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
456	202607303544.exe
456	202607303544.exe
4588	202607303544.exe
4588	202607303544.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
456	202607303544.exe
4588	202607303544.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4756	456	202607303544.exe	86
PID 456 wrote to memory of 4756	456	202607303544.exe	86
PID 4588 wrote to memory of 1924	4588	202607303544.exe	89
PID 4588 wrote to memory of 1924	4588	202607303544.exe	89

C:\Users\Admin\AppData\Local\Temp\202607303544.exe
"C:\Users\Admin\AppData\Local\Temp\202607303544.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\system32\RuntimeBroker.exe
  "C:\Windows\system32\\RuntimeBroker.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  PID:4756

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_t0magwpk\202607303544.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_t0magwpk\202607303544.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\system32\RuntimeBroker.exe
  "C:\Windows\system32\\RuntimeBroker.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

202607303544.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_t0magwpk\202607303544.exe
Size 6.3MB
SHA256 46e22c3febad57d20dfb3b3a349ed43570794edc7a5f80008c3dc5970d84c3b9
MD5 5f37017ca5051bc6df07f398b59f2e50
SHA1 3f7a740d898a7d4878afcab409a09eefcc55da0b
SHA512 dd1345fea101b9f3456040fe7b801ee249a92dea8650d7a5809d77fafa90a49d698fad4dc5874af78103ba1488fa96a6ca0806de33699965d8b5cbc0c4a99e55
SSDEEP 98304:y5tpLkt6IPYonsoseROg7OcqV0yExvfUJSAjk/PTiJay9tc08gsM+cZs:ym5YonsCqdVu9cJSAjkGcq+cZ
TLSH
T1AD66332321885084F3A463348576D569DAB1BC617BA547CF87043ABA1F3BBE79C3B319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tedutil.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_t0magwpk\tedutil.dll
Size 55KB
SHA256 cc873c23a5d2eae22dc0268e8c4ea1238313173e8bc0dac4c33283b94ba20b4d
MD5 6334f9a1cd33220d47224000e8883499
SHA1 6ab74dcbc84ee90d178c542e5d1ae10cde150332
SHA512 b663e275e7d965b492e51917219b5260f21e8fe1f3035bab256d1c08b17f68d53720d0e51527923dcd0455c2061c1e8aa058b5e15c3c8deca926a949e0f09b59
SSDEEP 1536:fCa7a7ccMADZKIn7CJ33ous2ePhnDb8KxcG3yUcWzxU:fCr12eZnDY8yUcWi
TLSH
T1CA431883F36560ADC127C134C7E9A273F6B4B9A91A302D5E4A90CE762C54F40573EF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tedutil_original.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_t0magwpk\tedutil_original.dll
Size 298KB
SHA256 02803028ea10dd92e8856c6553fc4ba6b3c09d973f4fc82226bfd2c42f0e6b06
MD5 d0e37647c1e6819fff84835b5f435241
SHA1 6afe9c9912d5e3031e7f0450cea9642054f8fa7d
SHA512 7a1fd746500432830cfa0da5b0c083b9cbcea2c35eac5f9e26509ac562262e9ea21261c51b649ab6b38d3aec1d4504bd61515bf91912e4f833b8df50722bbbbf
SSDEEP 3072:tjzJ49xlJjz+GR6Z37S1NeAq7ng5vd7elS3QYgsKDSHxsgsqAfJcarjtcxcWi:tjzJWtjz+GcZ37Z7gzvgYgCHgq5arjh
TLSH
T19254F99633E80CE5F7A671BD8657C64EEBB27881175382CB0224015A4FBBFE45D3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-0-0x0000015C52300000-0x0000015C52301000-memory.dmp

Download

memory/456-11-0x00007FFA71230000-0x00007FFA71243000-memory.dmp

Download

memory/1924-15-0x00000137B9DC0000-0x00000137BCDDD000-memory.dmp

Download

memory/4588-16-0x00007FFA6EE30000-0x00007FFA6EE43000-memory.dmp

Download

memory/4756-1-0x0000023A23F90000-0x0000023A2459F000-memory.dmp

Download

memory/4756-5-0x0000023A279C0000-0x0000023A2A9DD000-memory.dmp

Download