donutloader | 2d749afda12342cd0a74376210d0dc65d47169c1b9522adf4ada953ea11de1da

Analysis

max time kernel
299s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice Confirmation.bat
Size 2.4MB
Sample260910-rbwncadj4z
SHA256 2d749afda12342cd0a74376210d0dc65d47169c1b9522adf4ada953ea11de1da
MD5 3afaf06d125094b8155c77992bcfd660
SHA1 a5ed0058428c3fa3d8f38f874c98bc29e58c59ad
SHA512 b8ffc34bfc85b209ee828bb71b261a39f37072d29d5b2ecc6120e3d5186a7589e0e4227c832d13e06280635aef659b8aac6ada9ac17d573c6bad63c5e7d44319
SSDEEP 24576:j9ZhIuYkpR034slanDSb2PcymHpGlnyfEpuTB8bgh7Ik9Th:yuhBXXAtf
TLSH
T16BC59E0B48E72A3D97D4324D50BEE64F2E9011B7AECC156FDA2529697DBB94CC00F0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

gameofloveweb.duckdns.org:8800
gameoflovewb.gleeze.com:8800

Mutex

S288GhGa9LwmVeuI

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2776-36-0x0000000007550000-0x0000000007560000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2232-34-0x0000000000AC0000-0x0000000000AD1000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3652	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5532	vijewyufveonabghulluonouceyasi.exe
1064	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\GIFT PRESIDENN = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	reg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2432	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3652	powershell.exe
3652	powershell.exe
2232	charmap.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	2232	charmap.exe
Token: SeDebugPrivilege	2776	charmap.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	charmap.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3652	4832	cmd.exe	89
PID 3652 wrote to memory of 2432	3652	powershell.exe	91
PID 3652 wrote to memory of 1064	3652	powershell.exe	94
PID 1064 wrote to memory of 2232	1064	vijewyufveonabghulluonouceyasi.exe	95
PID 1064 wrote to memory of 2232	1064	vijewyufveonabghulluonouceyasi.exe	95
PID 5532 wrote to memory of 2776	5532	vijewyufveonabghulluonouceyasi.exe	96
PID 5532 wrote to memory of 2776	5532	vijewyufveonabghulluonouceyasi.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w hidden -exec bypass -F "C:\Temp\update.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "GIFT PRESIDENN" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2432
- - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
    "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\SysWOW64\charmap.exe
      C:\Windows\Syswow64\charmap.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2232

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\SysWOW64\charmap.exe
  C:\Windows\Syswow64\charmap.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 67KB
SHA256 4b5924dfe828847dacd43a329a20813a3352197d5056ca8f6020d1cc30e73407
MD5 1bb7db2e677d2ba2b5bd32697eddc572
SHA1 40acf9d843b5ed941c6a594f6c0ead447d160774
SHA512 7dff8e68f5a21b2bb2496f464a1096e6e4de20a90584ff86fde77a8ec840c7e1d68fcec4a66e587785a12657c2adc07845a500809335edd6963655c58c208028
SSDEEP 1536:vdbi/t2pqawJdTOUjmn2RaSZNcUhEi+Li76MCfpy+eob6x+UBW:lUQpaRa0GUhm+8xy+dbDUc
TLSH
T1B563E180DE276CBE33B1CD4D978A487B0A78172D0D36CE558FE2DA15937BA776326204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 3KB
SHA256 853a813183f0a1869905c5879dda2e85726658cd18149fc4a61bb9a861f6c9cf
MD5 af666b097dbe0d7f56a0eebd6355ea89
SHA1 1d2a519a6ebb8b3d2a6877ecfa0776c92835c97a
SHA512 d292b2813403c85b3507a4fed29af6e23a420d887e77a2c2b102f97ca0c78778492b64ccbe91b5f6b1e197ed7df549927a93bb286372a4fbd9f91a562b5840fd
TLSH
T19351E0C47C0FE5402CA8211A9D29CE6BF79EADAF053D01313E99C2959FAC7BCE048748
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2232-42-0x0000000008FD0000-0x0000000009036000-memory.dmp

Download

memory/2232-41-0x00000000080A0000-0x00000000080AA000-memory.dmp

Download

memory/2232-40-0x00000000080D0000-0x0000000008162000-memory.dmp

Download

memory/2232-39-0x00000000081A0000-0x000000000875A000-memory.dmp

Download

memory/2232-37-0x0000000003C60000-0x0000000003CFC000-memory.dmp

Download

memory/2232-34-0x0000000000AC0000-0x0000000000AD1000-memory.dmp

Download

memory/2776-36-0x0000000007550000-0x0000000007560000-memory.dmp

Download

memory/3652-10-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-33-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-15-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-17-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-18-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-19-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-14-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-11-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-13-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-16-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-12-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-2-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp

Download

memory/3652-9-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-8-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-7-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3652-6-0x00000232EA450000-0x00000232EA472000-memory.dmp

Download

memory/3652-3-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download