donutloader | ff6379a044085e27758b1718515b16869a1bba31bb5e31b989aeaf07178fe87a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/10/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-07_2915aca201ab1167ccc0918b08ae1ee0_cobalt-strike_icedid_satacom_stealc.exe
Size 151KB
Sample261008-tpblfass6l
SHA256 ff6379a044085e27758b1718515b16869a1bba31bb5e31b989aeaf07178fe87a
MD5 2915aca201ab1167ccc0918b08ae1ee0
SHA1 b6ff13a6feba1f1d973026dc2e79f783a601f61c
SHA512 7a7d6d19c9548eac4f858c80b6b22adb5a24b43ffb4ff00653a9f69a5c6cc552a933ebca5821305d9fc6004486ffd57e757457029aa9a64816d81cfb53192349
SSDEEP 3072:kW4ssEIrEwrxwTWxqLflso/Gadg21ony/n:D3yxFsz9d1
TLSH
T19EE33A5B73A530F9E277923885A61A42F77278310751AFEF0360467A1E633D09E3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/files/0x000600000001b857-3.dat	family_donutloader
behavioral2/memory/1296-4-0x0000025491F30000-0x0000025491F73000-memory.dmp	family_donutloader

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-07_2915aca201ab1167ccc0918b08ae1ee0_cobalt-strike_icedid_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-07_2915aca201ab1167ccc0918b08ae1ee0_cobalt-strike_icedid_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-07_2915aca201ab1167ccc0918b08ae1ee0_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-07_2915aca201ab1167ccc0918b08ae1ee0_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fa[1].bin

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8999WJP3\fa[1].bin
Size 267KB
SHA256 7d46b869f4cedd631c359629581cf0e86dfbbf92622c21e91e2a4b4a4e8036a3
MD5 d32f105a0f00e166299c00c6dfda96d0
SHA1 04c42fa9a96adc65bcb5d58e091ed67c691152c9
SHA512 2e4b1d1f312e8878eab7604d1ac8689b1af4180bd765407af5ce750c91e5988866281a051fd4496b27c6647d756595fbba49cb9f538bef98252a486fcedf2688
SSDEEP 6144:W6+0/dvHf9itjW1eFTFWEPVPZ1wJ9PMwTmaBwqm6ysB:FBHf4tjW1eFTw6PZmt4apm6JB
TLSH
T1D944127AB2B115D5DBE0C442BC21F72FFFD2641DA5182586DB419E407AA3D43EB8C09D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-4-0x0000025491F30000-0x0000025491F73000-memory.dmp

Download

memory/1296-5-0x0000025491FC0000-0x0000025491FFE000-memory.dmp