donutloader | 11a258ccf1bf0cc0a8edfd2b5afda3e7bf6b1b4b25936ff32e7db5b48514b66b

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1024KB
Sample260803-sn8dcasfld
SHA256 11a258ccf1bf0cc0a8edfd2b5afda3e7bf6b1b4b25936ff32e7db5b48514b66b
MD5 ccbe729552b9298fd594305af3527bd3
SHA1 d900e63ac7565f73c329d3087ecb569d8e37f250
SHA512 cfec23fa2976cd7ef4ec4908da8cf143a2545d247b6b7ec2c269d520c6766d95470f6a96fe02d32b7f44c5234caa1006910aef62ee500006d6f66a2a6a0dbb35
SSDEEP 3072:gFqea5uWbxMIVpgIEcl/MsOv6p+Tw1H6oL95lDTqHpl00X2Qid3FiQ14UtHsVIvT:AYM9CpUhwPkny3FOVIvW5VXrtmH
TLSH
T13F257E59B7A918FAEE77D13CC9524505EA72BC524760E7CF03A00AA61F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution donutloader remus_stealer loader persistence stealer

Malware Config

Extracted

Family

remus_stealer

http://zelpx.garden:9895
http://fimmora.surf:6504
http://tzpx.courses:4437

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/1860-6-0x000001A86D370000-0x000001A86D3AF000-memory.dmp	family_donutloader

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2852	cmd.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2708	systeminfo.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2852	1860	file.exe	89
PID 2852 wrote to memory of 1244	2852	cmd.exe	91
PID 1860 wrote to memory of 2708	1860	file.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c defrag C: /b > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\Defrag.exe
    defrag C: /b
    3⤵
    PID:1244
- C:\Windows\SYSTEM32\systeminfo.exe
  systeminfo.exe
  2⤵
  - Gathers system information
  PID:2708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

temp_893f0f0c_00abd551.bin

Path C:\Users\Admin\AppData\Local\Temp\temp_893f0f0c_00abd551.bin
Size 10KB
SHA256 7bb2c832df14f986d0062e4986faf58bf7514bf3044bd0be15db26993f0c6191
MD5 6d32c92b9c304f39549d24307d961169
SHA1 04c982a4295c5253eff1c3b5c9d79eb962fe91fe
SHA512 f3795bff79e8c809f77d13db6e0d25ae3bdac79f9c12f3f0494944484b4ba26592120fb82729ecabf35eb30858d88085c159715b9f897b9378cf5f65d14803f1
SSDEEP 3:9Kl89dbaMSqd96FIIUJyud9dbaMSqd96FIIUJyud9dbaMSqd96FIIUJyud9dbaMR:WC
TLSH
T1962212B8E434D278020F21000B1736F7048A302C10242D0AE388F2E0996B98AF980000
MD5 SHA1 SHA512 SSDEEP TLSH