donutloader | d52240aaee46e30c32c45eb125bcefeda10a8e92832e990c78dc5dbecd525b58

Analysis

max time kernel
179s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d52240aaee46e30c32c45eb125bcefeda10a8e92832e990c78dc5dbecd525b58.vbs
Size 1.7MB
Sample260807-yz36nasgra
SHA256 d52240aaee46e30c32c45eb125bcefeda10a8e92832e990c78dc5dbecd525b58
MD5 684e20c99ab2aeab758fcf0c5cfb04f3
SHA1 2d5967e387b645775713d3038a0e75c6fec21fce
SHA512 9fcd1253494f86363098551721e476b77ae9998e8c42bce2b4840dbc871f2ef54e29e1f36a26373f686cdcdbca6a250e2831560679078817dc77485252de85e1
SSDEEP 24576:JHYmV/5LnV48d7H2Xk9Eyg2kqAslyrhpEOdf7rUnU18/0ptZmF6kn1I/T7y/8wMp:J4mB3V72glkrUDF6SHfnE
TLSH
T187853325CD757DBC4EF84158605FAE8D7EB60ECA088DB2DB6BA54CCB429CA800617C79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/1584-33-0x0000000000940000-0x00000000009EA000-memory.dmp	family_donutloader

Executes dropped EXE 2 IoCs

pid	Process
5472	vijewyufveonabghulluonouceyasi.exe
2688	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\cookitemp = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2884	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5112	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3460	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4384	4800	WerFault.exe	100
3680	1584	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5112	powershell.exe
5112	powershell.exe
2612	powershell.exe
2612	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 5112	2884	WScript.exe	89
PID 2884 wrote to memory of 3460	2884	WScript.exe	91
PID 3460 wrote to memory of 2612	3460	cmd.exe	93
PID 2612 wrote to memory of 2688	2612	powershell.exe	96
PID 2688 wrote to memory of 1584	2688	vijewyufveonabghulluonouceyasi.exe	98
PID 2688 wrote to memory of 1584	2688	vijewyufveonabghulluonouceyasi.exe	98
PID 5472 wrote to memory of 4800	5472	vijewyufveonabghulluonouceyasi.exe	100
PID 5472 wrote to memory of 4800	5472	vijewyufveonabghulluonouceyasi.exe	100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d52240aaee46e30c32c45eb125bcefeda10a8e92832e990c78dc5dbecd525b58.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$in='C:\Users\Admin\AppData\Local\Temp\tmp529754.bat.gz';$out='C:\Users\Admin\AppData\Local\Temp\tmp529754.bat';$fs=New-Object IO.FileStream($in,[IO.FileMode]::Open);$gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress);$ms=New-Object IO.MemoryStream;$gz.CopyTo($ms);$gz.Close();$fs.Close();[IO.File]::WriteAllBytes($out,$ms.ToArray());Remove-Item $in"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp529754.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -exec bypass -F "C:\Users\Admin\AppData\Local\Temp\aqxuklgowzoifs.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\nslookup.exe
        
        C:\Windows\Syswow64\nslookup.exe
        5⤵
        
        PID:1584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 84
        6⤵
        Program crash
        
        PID:3680

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Windows\SysWOW64\nslookup.exe
  C:\Windows\Syswow64\nslookup.exe
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 88
    3⤵
    - Program crash
    PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1584 -ip 1584
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4800 -ip 4800
1⤵
PID:5136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e7183def1d29fd0395cd78b009e2f8b5e4f480395cf2985ccbc0322108a84822
MD5 29306a677d74adb5fff04743e73442dc
SHA1 c5dc81d098e4886febc7d7945933aff03157db88
SHA512 b91331628ce3096d47af64b27e4ca74a0d6ad7aeecbde9afe14d0ee73c380c5e6f262b8fa3fa7177b83c408f05d1a38acb9e3a4c9e32f9fc698225221918f2be
TLSH
T1A9217F37B3DC8714DC9A413A50CDAC1036B5C7D7419ECF6B7B84D544B42F599DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

tmp529754.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp529754.bat
Size 1.7MB
SHA256 fbfcbe833a93fc525aab96ee615c7b8aa8f7fb86270c7dcdf37ac965ae186e90
MD5 02e79430bc31a9cb87474d553c8a21e7
SHA1 6f720b08e407436ee1c906f3a7c253084ed19177
SHA512 5ef3e87b025f1b79f54b1739588ca6451aac74a91494b9715723a35d375a4cc9a0e4e6f8d95686d690ae73876169101696003fc268ff12d57ad1b4841f3b138e
SSDEEP 24576:JLIvZ3I0SJK8C3tPkjf+ICP1uDS6yfaA8ICE04pPsO+Bx373qLFpMAeHjbeuGGiS:JLIvF/n3faA8RJO+B1m5uGGkE
TLSH
T1718533104BF74DAA991CE25A709EDF2F2AF10F8B8C09F89E17B571CA205E2590D63D61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp529754.bat.gz

Path C:\Users\Admin\AppData\Local\Temp\tmp529754.bat.gz
Size 1.3MB
SHA256 b0ca160d9ea476339bb3c9fc193f2df43f896013b4a6e7a162a65f7788337352
MD5 71803d7fb375a355533fabc37f510bc1
SHA1 f3f80d48387c56229a513435c7bfd5ebdad6e6a7
SHA512 9a07a65aec2e4852a47c0ab24d8bbc9bbde503577a3fc1b8d437178fca9824355b22a1ac85821d27c6cd121fd5b1d09fb23437ed219d478b61de5b5a5d5ff653
SSDEEP 24576:E+a6C7pZs86flRa1ntoIBboK6G3/s6TnSv+gTSc0BExBtcHzTRl7N+Hd1UZIMgwY:E+a9661ntncGPs6TSv+KgEBcTdl89/3h
TLSH
T16B5533DDDDC1F9C6CC17574446B2096E2930CBA7987ED7AA6FE0A292D3AF45A3D40230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 676KB
SHA256 17a92f3f7034673bb7a0ff41f57e9a2134c3f1be63e082bdbfc881b5248c26c6
MD5 9bed492529644a98fe65a9bb7dd59a5f
SHA1 eb8cc4b28b8fd28773a0bf96770b4550e1fdd637
SHA512 b62b35500213bd1fa26b855ce4eca4d964a277a4ffe80ce823a6acd7c2ea1be90e6ee25c33b5b68cfec4d77bc0bc51c14f7de4165e0b9fe969474d6f1b98d836
SSDEEP 12288:6GaYcSg0sLwZhv0dBMzgOyMiWUt6ysc66ZX9ak7ANmGWWV:63Wsgv0GfyM2t6FcnkNmGWo
TLSH
T1EEE42384DAFA7D1D27D5CDCAD76700374B3A27169EDFC8600C27D8661BA9F220A11B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 1KB
SHA256 1ca2aafc7d192703e988961cd34fafa29af18273a28d494512117c3de2e2aa6c
MD5 13d1cd9dfb35efaa35dcd37af2b84fad
SHA1 017a914574c1d246459d1a7641ec36a0f7b78936
SHA512 96ae03fcfc06839c79906d9c1ffb27f48d11be77ba3c3865e4fbcc01ef3de694544778e6e020402f23194a59b821f8e3647a71d1bd346dfc5256803a43427b4e
TLSH
T1C43100981E77E6030365D3CABE3BCB037B181995A1AD06533BD30A602914F5DFC8638B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-33-0x0000000000940000-0x00000000009EA000-memory.dmp

Download

memory/5112-6-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp

Download

memory/5112-7-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp

Download

memory/5112-8-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp

Download

memory/5112-1-0x00007FFDF023F000-0x00007FFDF0240000-memory.dmp

Download

memory/5112-10-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp

Download

memory/5112-13-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp

Download

memory/5112-5-0x00000122CDBE0000-0x00000122CDC02000-memory.dmp

Download

memory/5112-2-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp

Download