donutloader | d3060eed44a1e1ddf2969249eac39dbfc110a7732b450aa437f04705edc91f37

Analysis

max time kernel
298s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice_Confirmation.bat
Size 2.4MB
Sample260822-vgd72aff49
SHA256 d3060eed44a1e1ddf2969249eac39dbfc110a7732b450aa437f04705edc91f37
MD5 c68d8cc245bac361c06951415848ab9b
SHA1 4542c33254d624c3753fcd56f9876fbe1e108218
SHA512 5533b2959e383a11a57462398f4188b773b30013ae2d914e2e714d2e43dfe208b4bb3e1da912dff56dc4bcbfc25641698299ec6f792803d86312dfe955c3642b
SSDEEP 24576:D/ead2DS7DUjs0xeumkOyk/G9NvP5NH7lO1LjQYNlAIK/vDmDyGdKDgx:DeHD/mAcOgx
TLSH
T15DC59E0748E72A3DA7D4324D50BEE64F2E9011B7AECC146FDA2529697DBB94DC00F0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

91.92.42.65:8800
gameoflovewb.gleeze.com:8800
gameofloveweb.duckdns.org:8800

Mutex

axQsQlVwMt8tc0v0

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2960-34-0x0000000005890000-0x00000000058A0000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/2960-32-0x0000000000C20000-0x0000000000C32000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2152	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4144	vijewyufveonabghulluonouceyasi.exe
3452	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GIFT HO = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	reg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4848	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2960	mspaint.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2152	powershell.exe
2152	powershell.exe
2960	mspaint.exe
2960	mspaint.exe
3656	mspaint.exe
3656	mspaint.exe
2960	mspaint.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2960	mspaint.exe
Token: SeDebugPrivilege	3656	mspaint.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2960	mspaint.exe
3656	mspaint.exe
3656	mspaint.exe
2960	mspaint.exe
2960	mspaint.exe
2960	mspaint.exe
3656	mspaint.exe
3656	mspaint.exe
2960	mspaint.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2152	2100	cmd.exe	84
PID 2152 wrote to memory of 4848	2152	powershell.exe	86
PID 2152 wrote to memory of 4144	2152	powershell.exe	87
PID 4144 wrote to memory of 2960	4144	vijewyufveonabghulluonouceyasi.exe	88
PID 4144 wrote to memory of 2960	4144	vijewyufveonabghulluonouceyasi.exe	88
PID 3452 wrote to memory of 3656	3452	vijewyufveonabghulluonouceyasi.exe	92
PID 3452 wrote to memory of 3656	3452	vijewyufveonabghulluonouceyasi.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Invoice_Confirmation.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w hidden -exec bypass -F "C:\Temp\update.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "GIFT HO" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4848
- - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
    "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\SysWOW64\mspaint.exe
      C:\Windows\Syswow64\mspaint.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2960

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\mspaint.exe
  C:\Windows\Syswow64\mspaint.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.ps1

Path C:\Temp\update.ps1
Size 2.4MB
SHA256 d3060eed44a1e1ddf2969249eac39dbfc110a7732b450aa437f04705edc91f37
MD5 c68d8cc245bac361c06951415848ab9b
SHA1 4542c33254d624c3753fcd56f9876fbe1e108218
SHA512 5533b2959e383a11a57462398f4188b773b30013ae2d914e2e714d2e43dfe208b4bb3e1da912dff56dc4bcbfc25641698299ec6f792803d86312dfe955c3642b
SSDEEP 24576:D/ead2DS7DUjs0xeumkOyk/G9NvP5NH7lO1LjQYNlAIK/vDmDyGdKDgx:DeHD/mAcOgx
TLSH
T15DC59E0748E72A3DA7D4324D50BEE64F2E9011B7AECC146FDA2529697DBB94DC00F0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_11cvtqr2.xg5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_11cvtqr2.xg5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 69KB
SHA256 c4db216584b5aa851508428aa3eb6a46ef6ca3cb10670d063fb45060ba6766de
MD5 21f1cea22d6ae30c550ace3d3bde6525
SHA1 8e49cfdf6f6558dda9d6a8f18a5c6ca908983342
SHA512 a7681da5dac46ab3be370ad141a3d9bd7a29a62d1d090f47f68b73c25f0a315abb351c31651fa9ab45162cb57537f0ab064ae2bbc036707621a387cf4e49c856
SSDEEP 1536:mA90jKNw/Q/DAZwnStKRKlh39LiwNz/LjOFSZrJbUhEi+Li76MCfpy+eob6x+UBW:bOKN4Q/DA6nS8U3FzyFMrJbUhm+8xy+3
TLSH
T1F263E180C9B52CED6771EC1FDA97583E0F34473A4239CD948EE28429879BDB6A31D60D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 3KB
SHA256 b480e236500d9c3a1aaf4237a5233e0803185f07f4db2c3fdbc0e8eaa3751063
MD5 91a39d98ada2ebe0dd7ebf059e131d42
SHA1 2b3d8332c35fcead982a9b05322b6c1dbc693677
SHA512 6bc071bfdd57d5a8c313c933ff608eb0a1523ab66c3d989d245a638ca8dd5ff63858e6aaf56bac5f87bb2716db6d447d654696643ad96dd4dcb6b85e908e022c
TLSH
T16A51E0C47C0FE5402CA8611A9D29CE6BF79EADAF053D01307E99C2959FAC7BCE048748
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2152-6-0x0000022655EE0000-0x0000022655F02000-memory.dmp

Download

memory/2152-4-0x0000022656050000-0x0000022656060000-memory.dmp

Download

memory/2152-29-0x00000226580D0000-0x00000226582EC000-memory.dmp

Download

memory/2152-5-0x0000022656050000-0x0000022656060000-memory.dmp

Download

memory/2960-32-0x0000000000C20000-0x0000000000C32000-memory.dmp

Download

memory/2960-34-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/2960-35-0x00000000059C0000-0x0000000005A5C000-memory.dmp

Download

memory/2960-37-0x00000000091F0000-0x0000000009794000-memory.dmp

Download

memory/2960-38-0x0000000006F90000-0x0000000007022000-memory.dmp

Download

memory/2960-42-0x0000000007180000-0x000000000718A000-memory.dmp

Download

memory/2960-43-0x0000000008D50000-0x0000000008DB6000-memory.dmp

Download