donutloader | 9abab5bba27f0f089ba4bf0535456561031d4d941d78bfe23d480c3836642681

Analysis

max time kernel
38s
max time network
39s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cam_Scann_13_10_2026.zip.vbs
Size 4.3MB
Sample261013-3vb9lasx3p
SHA256 9abab5bba27f0f089ba4bf0535456561031d4d941d78bfe23d480c3836642681
MD5 3d4bfcef8e65ad84d4c34290e5bea962
SHA1 cc9e8632af4f2d390795298bc65898637a45d15f
SHA512 5f532501578a68317d3e47e45dbaedf4fdfcb0944e5970c70281cb2b9afbb3d75ed0d224c92c4df4ed4d63ca2bc9ae0c44cfb6ec5ee3f794f94dc131f35e925e
SSDEEP 24576:dXkrLBl3c7d7YbfmkRcgZQblqi0Ihovpmw6ex0Ms+h4+M4G9v+KFM1CGz1oqoWNS:MLeMJm
TLSH
T1FF269F516E5859F5EF8C690E90AEAF1D83F042176A33706BFB41DF04BE9A341864B21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader xworm loader persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.0

xwooooord2020j.duckdns.org:2020

Attributes

Install_directory
%Temp%
install_file
svchost.exe

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/5732-38-0x0000000003340000-0x0000000003356000-memory.dmp	family_xworm
behavioral2/memory/4652-41-0x0000000002890000-0x00000000028A6000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5732-36-0x0000000001200000-0x0000000001218000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
256	powershell.exe
3448	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	iexpress.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	iexpress.exe

Executes dropped EXE 2 IoCs

pid	Process
4540	vijewyufveonabghulluonouceyasi.exe
5132	vijewyufveonabghulluonouceyasi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\vdsgghj = "\"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\vijewyufveonabghulluonouceyasi.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\SetupFiles\\wwmaw\""	reg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4788	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexpress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vijewyufveonabghulluonouceyasi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexpress.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6036	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3448	powershell.exe
3448	powershell.exe
256	powershell.exe
256	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeDebugPrivilege	5732	iexpress.exe
Token: SeDebugPrivilege	4652	iexpress.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3448	4788	WScript.exe	88
PID 4788 wrote to memory of 3992	4788	WScript.exe	90
PID 3992 wrote to memory of 256	3992	cmd.exe	92
PID 256 wrote to memory of 6036	256	powershell.exe	93
PID 256 wrote to memory of 4540	256	powershell.exe	94
PID 4540 wrote to memory of 5732	4540	vijewyufveonabghulluonouceyasi.exe	96
PID 4540 wrote to memory of 5732	4540	vijewyufveonabghulluonouceyasi.exe	96
PID 5132 wrote to memory of 4652	5132	vijewyufveonabghulluonouceyasi.exe	98
PID 5132 wrote to memory of 4652	5132	vijewyufveonabghulluonouceyasi.exe	98

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Cam_Scann_13_10_2026.zip.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$b64=[IO.File]::ReadAllText('C:\ProgramData\edr_marker.b64');$raw=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b64));[IO.File]::WriteAllBytes('C:\ProgramData\edr_marker.bat',[Convert]::FromBase64String($raw));Remove-Item 'C:\ProgramData\edr_marker.b64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\edr_marker.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -nop -w hidden -ep bypass -f "C:\Temp\update.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v vdsgghj /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe\" \"C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:6036
  - - C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
      "C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\Windows\SysWOW64\iexpress.exe
        
        C:\Windows\Syswow64\iexpress.exe
        5⤵
        Creates a file in the Startup directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5732

C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
"C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe" "C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\SysWOW64\iexpress.exe
  C:\Windows\Syswow64\iexpress.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edr_marker.b64

Path C:\ProgramData\edr_marker.b64
Size 8.7MB
SHA256 5be922f6fffcc63aed787fe6b13ff9a1838d7341ebfcbac92777b0fcf7dc3698
MD5 4723e52106648589469d425d0ef941cf
SHA1 e6516b7a9394038b6c18e9884b31b29ce8c8876e
SHA512 30f49084b13eedb6e7743be47b0724edcfcce97527d772398f24562424bb5734b086e7e8e5766beae0f5bc4256d06f51dfe4cbbb5e99eff511961e7f0a0fe72d
SSDEEP 24576:w8RvkbDdlfqxxOPXA7FzAnKxhHy5iWE47PKXYGbC+MxLh5D2FBmTC3le5kPSH2Qh:w
TLSH
T18F964438B9BB51495837FF523EECB9EADCDE1B226945541B1041070BDA22AD0EF2387D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edr_marker.bat

Path C:\ProgramData\edr_marker.bat
Size 2.4MB
SHA256 36361f9e6031edc9312632c65018a22dedc1f58b60a7e344b6add50c4942e79e
MD5 53ca43197a30e5a2399dd514acafca39
SHA1 07e6bc74937a747410c2a52f9a428c9a1a6bd089
SHA512 f0eb56d28ccce5a5e340d7b84549d5caf51a55f3cd2ec856c1792a72a4044f194c5b2c7f2a4e9b4a46dbca265337a009d728660054a1961dd633d87affcb3140
SSDEEP 24576:n0wrdV+t02czD+6IuYkpR034slanDSb2PcymHpGlnyfEpuTB8bgh7Ik9T8s:bUuhBXXAt1
TLSH
T147C59E0B48E72A3D97D4320D50BEE64F2E9051B7AECC156FDA2529697DBB94CC00F0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_smztrq3p.igk.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_smztrq3p.igk.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Ennnn

Path C:\Users\Admin\AppData\Roaming\SetupFiles\Ennnn
Size 93KB
SHA256 c2704fab868c0d157a7f0512ae80f7ec3c632fe6097625f00a29d0ceae3d0bc5
MD5 d5e68da8c1d84e7c893921aef74df31f
SHA1 dc0d51723808ffb64168c3803109a942cc40645f
SHA512 14d490f1252f245b2ecc8f6c061fe68baab0e0cc864357db7a40c2e0c8cfa9cef93599f36c8710f959ade11b5161fcd106dfd3a5fd026226acede3feef54fde1
SSDEEP 1536:DkZWcoyw5Ioqw+p7q2Z0upEDizOWY2S8iwFJq0D7SVjFc9AsqUhEi+Li76MCfpyo:Dkroywnqw+hqW0up7zOWY98iw+Pbc9An
TLSH
T15993F1A096B27CEF67B49D6DC34A183F0AB42B110D75DC844EFB8A19E766F622324704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vijewyufveonabghulluonouceyasi.exe

Path C:\Users\Admin\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwmaw

Path C:\Users\Admin\AppData\Roaming\SetupFiles\wwmaw
Size 3KB
SHA256 afcb9c0814aede6f4225e81f25fea5a0ff1fa634965dca1db9645b800f919cc7
MD5 a92aa340e1c2d744d890024165cdad35
SHA1 95069e6eb14f770b495418cc0c6fd2a0d3388b63
SHA512 ccc578ef4cdda78c1c8ad53ed9c71d9fe72a00ff857eb9e8a3f96b47465dbb7847e30ac917d579639e204fd941a8ef25cd0785abcc473bd74f6807382d748ec9
TLSH
T1CD61EFD47E8FE5801C6869559C29CE6FBB9EC8BF047D203039A482649F7D7BCF214A49
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3448-19-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-5-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-13-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-14-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-15-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-16-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-17-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-8-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-12-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-7-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-6-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-1-0x00007FFCE555F000-0x00007FFCE5560000-memory.dmp

Download

memory/3448-10-0x00007FFCE53D0000-0x00007FFCE5D74000-memory.dmp

Download

memory/3448-4-0x00000202496B0000-0x00000202496D2000-memory.dmp

Download

memory/4652-41-0x0000000002890000-0x00000000028A6000-memory.dmp

Download

memory/5732-36-0x0000000001200000-0x0000000001218000-memory.dmp

Download

memory/5732-38-0x0000000003340000-0x0000000003356000-memory.dmp

Download

memory/5732-39-0x0000000004A70000-0x0000000004B0C000-memory.dmp

Download