donutloader | 11db652095abfe193306e29164342735aeb7c6bdccb51a966c97253535c61b7f

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 305KB
Sample260910-24sr9sxclf
SHA256 11db652095abfe193306e29164342735aeb7c6bdccb51a966c97253535c61b7f
MD5 d253a31a21a6d91c3958c49cd0b723ba
SHA1 26dfc2d94a2c5a8f10ddf14edb6acecccc7c8274
SHA512 c7f4c76fe1848e75b3a6ba05b729debd8fc75d79947a0eb582df2d07c6f11d796592f0bc6e9d25bcd6f1ff01df41ee8e579f8e83210a928405886dc49af03f81
SSDEEP 3072:6eAxjQBULkLjstRcnU6s1OB/N8MdRsr5xBP5LKDmVb9CeNHsjHvd8yMGTHYHOtKi:67xQc1u18aClHgSja+HXMCBW
TLSH
T19A648D15F7A914F9EA77923CC9524506FA727C524760DACF03A04AAA2F237E09E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader remus_stealer loader stealer

Malware Config

Extracted

Family

remus_stealer

http://trencts.shop:8592/notifications
http://smaring.shop:9895/collections
http://quicbud.shop:7647/tasks

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4596-6-0x000001D2BDF00000-0x000001D2BDF42000-memory.dmp	family_donutloader

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4864	4596	2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Prefetch\*.* > nul 2>&1
  2⤵
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4596-6-0x000001D2BDF00000-0x000001D2BDF42000-memory.dmp

Download

memory/4596-7-0x000001D2BDF90000-0x000001D2BDFCD000-memory.dmp