donutloader | 00575262fc54fb8a46fe59c5abc2b9c5229491da480df9f74aa6acb6954b24f7

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NFe91648916160316975616710-27-09-2026.pdf.js
Size 3.4MB
Sample261002-1bz57stdkh
SHA256 00575262fc54fb8a46fe59c5abc2b9c5229491da480df9f74aa6acb6954b24f7
MD5 8dee19a60dc57ff33a9a9a9896b0902a
SHA1 113b28fbf77728c99f8c210f4424a007597b005a
SHA512 8794d6f9bd35a7dffedb652074be70d0df1f00b093b7148f0a175d8bd2bd1133e1922865b8d5e7af6c915f83c80a9bff04c2b2df36d646bba171f5fb80afc9cf
SSDEEP 49152:Y4yPhbkqZXuer0XHCTjCHYML2CbP7Ra9BtdFAPo8VY:U
TLSH
T16FF5F1C9BE6C57AA2F3ADC82117E9D6F3933AD93C450D694A164724ED302200B7F5E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4292-11-0x0000000000BE0000-0x0000000000BFE000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
1948	lyxnsngn.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4344	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lyxnsngn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexpress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4344	cmd.exe
2544	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2544	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	iexpress.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 1948	4128	wscript.exe	89
PID 1948 wrote to memory of 4292	1948	lyxnsngn.exe	90
PID 1948 wrote to memory of 4292	1948	lyxnsngn.exe	90
PID 1948 wrote to memory of 4344	1948	lyxnsngn.exe	91
PID 4344 wrote to memory of 2544	4344	cmd.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\NFe91648916160316975616710-27-09-2026.pdf.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Roaming\LocalState\lyxnsngn.exe
  "C:\Users\Admin\AppData\Roaming\LocalState\lyxnsngn.exe" "C:\Users\Admin\AppData\Roaming\LocalState\najdblzu.au3"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\iexpress.exe
    C:\Windows\SysWOW64\iexpress.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 3 127.0.0.1 >nul & del /f /q \"C:\Users\Admin\AppData\Roaming\LocalState\lyxnsngn.exe\"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kmkdf

Path C:\Users\Admin\AppData\Roaming\LocalState\kmkdf
Size 119KB
SHA256 4521e16b7160a5379fb26b3d412538f4c4e1bc5b414ee418193d8df749a08d88
MD5 180d8a3724f591dea7e2a774dd2495ab
SHA1 06f3931b932559a6057f7cc819d5a2e2716f39e6
SHA512 9ec160665b8a91905d51cb460d34243ac1271d58eeedba857e2a082110b36afef9e66ef6e481aed41d6d14f30a17d7f892a7ed63b4f3a92f2788958cb4b6d240
SSDEEP 3072:CNfpjPCJ1UOSo945cjUGEqGktgp5a7NGzNS1fGu5:CNfpr21U645cjn7NGzo1fN5
TLSH
T1CFC312FF6AED55C9FFE5BA0E88A11AC8C51960B6C310E595A793F0E121C8760FD82C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lyxnsngn.exe

Path C:\Users\Admin\AppData\Roaming\LocalState\lyxnsngn.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

najdblzu.au3

Path C:\Users\Admin\AppData\Roaming\LocalState\najdblzu.au3
Size 11KB
SHA256 f75e61cabcb39ceb4fe643a6017dd364ea724a0c6acb1e1ede6a35b18a6169cb
MD5 687e4a2131f969d76a391a6fe7cb31ea
SHA1 962c3be8743014c4cc4f36a4fb01262944635f06
SHA512 f250cd7005c127c5d343597756d1b49e5f09d3d1a02cebbcf1a6a2890446c7007cf24d879974382d372e775e5f81bbfed266537231cef74ec988edd5685acc18
SSDEEP 96:cebeyutPdkmGCGIGIGIGIGIGIGIGNNMJJrvJFGIG58xG0QOgvWjvuEnvuEYNsgP6:P4KStax+BV
TLSH
T14F324FC85D5ABFFCDAC2C859070DDB4944E029AA5B3880E5E97CF00C417B5BD5ACB9A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4292-17-0x0000000074380000-0x0000000074B3C000-memory.dmp

Download

memory/4292-13-0x0000000074392000-0x0000000074393000-memory.dmp

Download

memory/4292-14-0x0000000002E50000-0x0000000002E6C000-memory.dmp

Download

memory/4292-15-0x0000000074380000-0x0000000074B3C000-memory.dmp

Download

memory/4292-16-0x0000000074380000-0x0000000074B3C000-memory.dmp

Download

memory/4292-11-0x0000000000BE0000-0x0000000000BFE000-memory.dmp

Download

memory/4292-18-0x00000000055B0000-0x000000000564C000-memory.dmp

Download

memory/4292-19-0x0000000005C10000-0x00000000061CA000-memory.dmp

Download

memory/4292-20-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/4292-21-0x0000000074392000-0x0000000074393000-memory.dmp

Download

memory/4292-22-0x0000000074380000-0x0000000074B3C000-memory.dmp

Download

memory/4292-23-0x0000000074380000-0x0000000074B3C000-memory.dmp

Download

memory/4292-24-0x0000000006270000-0x0000000006302000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads