donutloader | 83cfa06e84360705a2fdfa332a8324e37dd9be45f23e37fa4a4a557f46e078f2

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tedutil.dll
Size 102KB
Sample260923-sr5rmathje
SHA256 83cfa06e84360705a2fdfa332a8324e37dd9be45f23e37fa4a4a557f46e078f2
MD5 24d21f9c82d4c8525fe473d125afa223
SHA1 88ed135a0b687f9b2c90d54f7ca33e5cde3e9e4e
SHA512 8e0a8644a3ad21195bd40785161f662692b899a3fd229e08e7dc653b4b8fcd2b2164b562e9b445e89c9d0079b03ca6a6e5115604317f5374cb0b1658fdf18f6e
SSDEEP 3072:Qqmc7LsppHxb1WhINEBkofoLmT5Onk6lsPGBIejgFm8MChYXfMFiroBRl/XmFMff:Qqmc7LcoALC5Onk6lsPGBIejgFm8MChE
TLSH
T139A357456575BCB8C526803E9207632293B23C4DC3316667BAE9DD243F97F606B2E7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader overlord loader persistence rat

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral3/memory/4320-18-0x0000022B24160000-0x0000022B24883000-memory.dmp	family_donutloader

Detects Overlord RAT 1 IoCs

resource	yara_rule
behavioral3/memory/4320-20-0x0000022B28DB0000-0x0000022B2C127000-memory.dmp	family_overlord

Executes dropped EXE 1 IoCs

pid	Process
5680	ExplorerBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate_k78f = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_k78fdJpl\\ExplorerBroker.exe"	regsvr32.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
16	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1688	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{9EE23AE9-2086-41E4-9706-9BB891657C93}	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3328	regsvr32.exe
3328	regsvr32.exe
3328	regsvr32.exe
3328	regsvr32.exe
1688	powershell.exe
1688	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeIncreaseQuotaPrivilege	1688	powershell.exe
Token: SeSecurityPrivilege	1688	powershell.exe
Token: SeTakeOwnershipPrivilege	1688	powershell.exe
Token: SeLoadDriverPrivilege	1688	powershell.exe
Token: SeSystemProfilePrivilege	1688	powershell.exe
Token: SeSystemtimePrivilege	1688	powershell.exe
Token: SeProfSingleProcessPrivilege	1688	powershell.exe
Token: SeIncBasePriorityPrivilege	1688	powershell.exe
Token: SeCreatePagefilePrivilege	1688	powershell.exe
Token: SeBackupPrivilege	1688	powershell.exe
Token: SeRestorePrivilege	1688	powershell.exe
Token: SeShutdownPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeSystemEnvironmentPrivilege	1688	powershell.exe
Token: SeRemoteShutdownPrivilege	1688	powershell.exe
Token: SeUndockPrivilege	1688	powershell.exe
Token: SeManageVolumePrivilege	1688	powershell.exe
Token: 33	1688	powershell.exe
Token: 34	1688	powershell.exe
Token: 35	1688	powershell.exe
Token: 36	1688	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89
PID 3328 wrote to memory of 4320	3328	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tedutil.dll
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\system32\RuntimeBroker.exe
  "C:\Windows\system32\RuntimeBroker.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -like '*C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_k78fdJpl*' } | Select-Object -ExpandProperty ProcessId"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1688

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_k78fdJpl\ExplorerBroker.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_k78fdJpl\ExplorerBroker.exe
1⤵
- Executes dropped EXE
PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ExplorerBroker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_k78fdJpl\ExplorerBroker.exe
Size 52KB
SHA256 eab4d04b91b95333d9d8ddeec5efc5fbd96ae1ab6a2d53905df6d3e9674926a2
MD5 c6fa446ed75472648ab2cc9d391298aa
SHA1 5f2d2e73c88a183477abbf4fc88d23e388d9092e
SHA512 ea32d49c982195035894beb77ebfb81e830ff37d3ef08e064ad1596f389a50a1e2237b330205e3e48087503e54d1245a1c1d3e6044a1ff0f11cb16ad1302f7fe
SSDEEP 384:zIATU0Vid2R57hHZhq78sQ7yvTWp5HZ4XrTZ9FCQl7v9rA9WrHLHW:3TUNQ7Hwwn7yvTWHHyZrC47v9BL
TLSH
T17F33080E67AA34E4E5BA473444731225D771B53127218EFF68E4C17A4F26AE0DA31F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_k78fdJpl\settings.dat
Size 7.1MB
SHA256 07b7dcccb71931c16b2b17da61fff70bc0ea67808306b4f303272c28bde1142f
MD5 7d534e3795dc9e113d220153ebc6fc2f
SHA1 4d081237fd61bd5a47da6681b37d948ca8bc9b06
SHA512 fc246178bdf57b66028e5f3b9c61bc4e9bf1151c1718719bcb57a47bf85022b9234c11c6d13675da9ba4a2b8021c55b4484d6e84a7107895b55b8f0a8ce61e22
SSDEEP 98304:4bKwkQlOx/Rm4QskC4nmEK2RJGhxkxPNBcQwpvn5yfgXOywtAieAkbG+84Ge/h+v:4PkVQsBERMh8lsJ5yfgeywYnbY7r
TLSH
T1557633A591CFA5D01C8032B33F9F911CC79ED9614E1826A3FAB4E58991F857F1E683C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tedutil.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_k78fdJpl\tedutil.dll
Size 102KB
SHA256 83cfa06e84360705a2fdfa332a8324e37dd9be45f23e37fa4a4a557f46e078f2
MD5 24d21f9c82d4c8525fe473d125afa223
SHA1 88ed135a0b687f9b2c90d54f7ca33e5cde3e9e4e
SHA512 8e0a8644a3ad21195bd40785161f662692b899a3fd229e08e7dc653b4b8fcd2b2164b562e9b445e89c9d0079b03ca6a6e5115604317f5374cb0b1658fdf18f6e
SSDEEP 3072:Qqmc7LsppHxb1WhINEBkofoLmT5Onk6lsPGBIejgFm8MChYXfMFiroBRl/XmFMff:Qqmc7LcoALC5Onk6lsPGBIejgFm8MChE
TLSH
T139A357456575BCB8C526803E9207632293B23C4DC3316667BAE9DD243F97F606B2E7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1688-26-0x0000023FC85B0000-0x0000023FC85D2000-memory.dmp

Download

memory/1688-29-0x0000023FE0770000-0x0000023FE078E000-memory.dmp

Download

memory/1688-30-0x0000023FE0A20000-0x0000023FE0AD2000-memory.dmp

Download

memory/1688-31-0x0000023FE0790000-0x0000023FE079A000-memory.dmp

Download

memory/1688-32-0x0000023FE07D0000-0x0000023FE07FA000-memory.dmp

Download

memory/1688-33-0x0000023FE07D0000-0x0000023FE07F4000-memory.dmp

Download

memory/4320-18-0x0000022B24160000-0x0000022B24883000-memory.dmp

Download

memory/4320-20-0x0000022B28DB0000-0x0000022B2C127000-memory.dmp

Download