donutloader | c2c8d1c3a85d23c7aef0edd81c4e2c21e2c17ae0add5bb8104db7a80b33df0bb

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_f01f1fd51adb4d71f46ed060aca15b3a_cobalt-strike_elex_icedid_njrat.exe
Size 805KB
Sample260817-gd7taahf64
SHA256 c2c8d1c3a85d23c7aef0edd81c4e2c21e2c17ae0add5bb8104db7a80b33df0bb
MD5 f01f1fd51adb4d71f46ed060aca15b3a
SHA1 9c7a2dbc39b425bb29adce0773a0136e9a026a59
SHA512 568db4f23dc2e82b08c17c553aa148c3b026c69d37ad575f8f26908fc9262bf50fbbeb620b5d33ace0a32e6b8c3e46e51607935b38acf2b46d56ecc2ec2efb50
SSDEEP 12288:CabExp8hsavOpFhcShyrtFne8yEt1ZXET57Mey9GFVer5+nHer5+nZoyw:C8ueeavqFuPejEvWN7MeEsXc
TLSH
T1B005E10D3A69A8D7C9324E34AC744696537268C37E911BB768D4530E8C7B2F88E67F34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/3096-0-0x00000000008D0000-0x0000000000962000-memory.dmp	family_donutloader
behavioral2/memory/3808-12-0x0000000000B70000-0x0000000000C02000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
3808	wyzym.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2024	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_f01f1fd51adb4d71f46ed060aca15b3a_cobalt-strike_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyzym.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3808	3096	2026-08-17_f01f1fd51adb4d71f46ed060aca15b3a_cobalt-strike_elex_icedid_njrat.exe	89
PID 3096 wrote to memory of 2024	3096	2026-08-17_f01f1fd51adb4d71f46ed060aca15b3a_cobalt-strike_elex_icedid_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-17_f01f1fd51adb4d71f46ed060aca15b3a_cobalt-strike_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_f01f1fd51adb4d71f46ed060aca15b3a_cobalt-strike_elex_icedid_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\wyzym.exe
  "C:\Users\Admin\AppData\Local\Temp\wyzym.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 362B
SHA256 77c54fcbb21c59202ff4dc96806e1e69c6b1bdde27ec17c51f2a653cf4ee3c71
MD5 0a3323163c62aeb9f9fb82e85f7e0696
SHA1 4dc760fae31763e4bba0cf7c62bd7f433789e551
SHA512 3921c4800c677dfb602fd81eafb69b6a05d029d0b6313f608ae5cd51bdab757a71cca771b61f45f9b2c3cec44794d8c0589f9fab5d0470275167dcb05fa89a33
TLSH
T1E6E02642CADBCA9E0CD7706B0AF6599CC024285D2F463718D769C85932E882DB9E2346
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 d631d901acf67afd343f88c7be86e4d7c97085a34195203fdddcdae99b6e44e5
MD5 ba364210a0e5d469dbbdf246e8ccd130
SHA1 3d361d7e01e75c643b28dd48135efce7f93486a5
SHA512 95e730ccbe938ef89e017427e36d059a9f3ed02c7d25dd69ed2098c22b7f6ee67cd431e8bbff79326f60afab364937e956062a9b7e0939546c238b2348adc1c6
TLSH
T1ABF02BF11075F01A3601D237C3D06FD413A30D440D83ACC44009B1708D39C1C4000312
MD5 SHA1 SHA512 TLSH

Submit Download

wyzym.exe

Path C:\Users\Admin\AppData\Local\Temp\wyzym.exe
Size 805KB
SHA256 309ce7b8e9307832b3358a43ffa3537e3e66d066ec84eda5131ad15b6cbc8b17
MD5 568b994a4565d632ad051ad1ab03d646
SHA1 90ce6ef629ba8f02906b24fa68aac9ca7f9ff306
SHA512 1f4095b46cf3ba5936245e1ccb234d91eec2f43cd8077b191667dc367462c2237140ab61c34f5cc68d5da08ed483af84389017672bc2309814bdb63bc0d307e9
SSDEEP 12288:CabExp8hsavOpFhcShyrtFne8yEt1ZXET57Mey9GFVer5+nHer5+nZoy5:C8ueeavqFuPejEvWN7MeEsXd
TLSH
T17C05E10D3A69A8D7C9324E34AC744696537268C37E911BB768D4530E8C7B2F88E67F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3096-0-0x00000000008D0000-0x0000000000962000-memory.dmp

Download

memory/3808-12-0x0000000000B70000-0x0000000000C02000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads