donutloader | 636a592091d9cbea5e75a1b838d2847cccf5ef04af510bede256ce90cf07d07e

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_5d7dfaac2bb303d58e0346049e77c78e_cobalt-strike_elex_icedid_njrat.exe
Size 805KB
Sample260820-b6aflaxgmf
SHA256 636a592091d9cbea5e75a1b838d2847cccf5ef04af510bede256ce90cf07d07e
MD5 5d7dfaac2bb303d58e0346049e77c78e
SHA1 b6de5099840af8c007f3f2ef29121dccee131a80
SHA512 a765a28a7314a69fbd35a624e5eb0fdd6929dfcf50b929fa8e6d0ca01398c6cba6393296cf1352bb531f321bb86d97d6c131dd5080d518882375fd44be4856e5
SSDEEP 12288:CabExp8hsavOpFhcShyrtFne8yEt1ZXET57Mey9GFVer5+nHer5+nZoyU:C8ueeavqFuPejEvWN7MeEsXA
TLSH
T19905E10D3A69A8D7C9324E34AC744696537268C37E911BB768D4530E8C7B2F88E67F34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2956-0-0x0000000000BA0000-0x0000000000C32000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
4936	ynjiy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_5d7dfaac2bb303d58e0346049e77c78e_cobalt-strike_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ynjiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4936	2956	2026-08-19_5d7dfaac2bb303d58e0346049e77c78e_cobalt-strike_elex_icedid_njrat.exe	89
PID 2956 wrote to memory of 4680	2956	2026-08-19_5d7dfaac2bb303d58e0346049e77c78e_cobalt-strike_elex_icedid_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-19_5d7dfaac2bb303d58e0346049e77c78e_cobalt-strike_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_5d7dfaac2bb303d58e0346049e77c78e_cobalt-strike_elex_icedid_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\ynjiy.exe
  "C:\Users\Admin\AppData\Local\Temp\ynjiy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 362B
SHA256 d7dc122c9b26661de8908fe77c69e7c91bc70355a8d9422fe37004038c0100d5
MD5 dfda90be7feae8fe87239f5ba5be6522
SHA1 b3705cdc19728a5e72505b88de25aa553d04870f
SHA512 3020943d90f2fcf6a869bc29dadf2475b0146eb5a72b68f79326af490f98eb36eae71d503d9629d2dcf0f2b6a228733d07badccb01f72f8d31c9e4e8c6df8311
TLSH
T121E0D80185EACADA0825B06B05FB598CC4306E0C2F4A77098754C48921D280DF5D6387
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 e79f483e86f9c7d0a0907b8a98fe5bfda0c0f0ead36d6616808609db652db037
MD5 96b44cc1cde462afbc59ba26b1fdbcde
SHA1 8f3228240df489cc1bc3a8dc28c033c36eb19d8c
SHA512 e88e98e4dbb2bd257cc8942face59d4199f6cbb61e46f62b152e14be69c1d130c936c47c83a45bff230113fee0a7c4ef371b04e4f000fd966752f4933314cbb3
TLSH
T152F04CD110B1B0653695A617D2851B5623A31E441E875DC04549B2706937A3C44D8696
MD5 SHA1 SHA512 TLSH

Submit Download

ynjiy.exe

Path C:\Users\Admin\AppData\Local\Temp\ynjiy.exe
Size 805KB
SHA256 add80b4e7ff8ec427f1b64da6093ed82a2387ae710140c717e09d6a1597aeafe
MD5 514d229f737f52334b8426b399aa9970
SHA1 470f11692cc660e0dd5a68cb645d02fd7b7df2d0
SHA512 59530fd9167fce03f408b074634b6948546025d908c15a76d9e2509b08a4073843e6c6ab5d1ec280d592a84d5ee3323b1b810c03a3276e71b5ed02e6d39392cd
SSDEEP 12288:CabExp8hsavOpFhcShyrtFne8yEt1ZXET57Mey9GFVer5+nHer5+nZoyJ:C8ueeavqFuPejEvWN7MeEsX1
TLSH
T14605F10D3A69A8D7C9324E34AC744696537268C37E911BB768D4530E8C7B2F88E67F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2956-0-0x0000000000BA0000-0x0000000000C32000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads