donutloader | e55cbde9ad71d3e41f5599325f2f54d6a8b91e2ad0a5852dc026411970e5114f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_44aa72d645a00463e4344dd8aca5f442_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 10.3MB
Sample261016-wevbxaat3m
SHA256 e55cbde9ad71d3e41f5599325f2f54d6a8b91e2ad0a5852dc026411970e5114f
MD5 44aa72d645a00463e4344dd8aca5f442
SHA1 567f4b5fd3492a5735758f7e13b365b2e2a1f6a0
SHA512 d0f10317b159247308bb8afa20ee997b278343765e2064e2f73b5b6c15b6b319fd44ef2cec6aa378d4b26d1f5f3eb84e4beede0f84ebcc59ca5c3f5622b5ae88
SSDEEP 196608:AJHcl2zBXyHZmvR9NI6ywz6j0yqiWyf04Kplxies//K9xxyfL1+:n4BYZm/Nhys6AVkcLx4/s6L0
TLSH
T111B6333C87E940BDD1A37BB88E42962DF27BF48556BAD703073509C56F237809DA4B92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader loader persistence

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3412-56-0x000002DEB8BC0000-0x000002DEB9503000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5856	powershell.exe
5492	powershell.exe
948	powershell.exe
108	powershell.exe
2440	powershell.exe
3180	powershell.exe
5856	powershell.exe
948	powershell.exe
108	powershell.exe
2440	powershell.exe
3180	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3412	WinUpdate_Helper.exe
3164	sysupdate.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3412	WinUpdate_Helper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3700	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinUpdate_Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinUpdate_Helper.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3060	mspaint.exe
3060	mspaint.exe
108	powershell.exe
108	powershell.exe
108	powershell.exe
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
5856	powershell.exe
5856	powershell.exe
5856	powershell.exe
5492	powershell.exe
5492	powershell.exe
5492	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	108	powershell.exe
Token: SeIncreaseQuotaPrivilege	108	powershell.exe
Token: SeSecurityPrivilege	108	powershell.exe
Token: SeTakeOwnershipPrivilege	108	powershell.exe
Token: SeLoadDriverPrivilege	108	powershell.exe
Token: SeSystemProfilePrivilege	108	powershell.exe
Token: SeSystemtimePrivilege	108	powershell.exe
Token: SeProfSingleProcessPrivilege	108	powershell.exe
Token: SeIncBasePriorityPrivilege	108	powershell.exe
Token: SeCreatePagefilePrivilege	108	powershell.exe
Token: SeBackupPrivilege	108	powershell.exe
Token: SeRestorePrivilege	108	powershell.exe
Token: SeShutdownPrivilege	108	powershell.exe
Token: SeDebugPrivilege	108	powershell.exe
Token: SeSystemEnvironmentPrivilege	108	powershell.exe
Token: SeRemoteShutdownPrivilege	108	powershell.exe
Token: SeUndockPrivilege	108	powershell.exe
Token: SeManageVolumePrivilege	108	powershell.exe
Token: 33	108	powershell.exe
Token: 34	108	powershell.exe
Token: 35	108	powershell.exe
Token: 36	108	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeIncreaseQuotaPrivilege	2440	powershell.exe
Token: SeSecurityPrivilege	2440	powershell.exe
Token: SeTakeOwnershipPrivilege	2440	powershell.exe
Token: SeLoadDriverPrivilege	2440	powershell.exe
Token: SeSystemProfilePrivilege	2440	powershell.exe
Token: SeSystemtimePrivilege	2440	powershell.exe
Token: SeProfSingleProcessPrivilege	2440	powershell.exe
Token: SeIncBasePriorityPrivilege	2440	powershell.exe
Token: SeCreatePagefilePrivilege	2440	powershell.exe
Token: SeBackupPrivilege	2440	powershell.exe
Token: SeRestorePrivilege	2440	powershell.exe
Token: SeShutdownPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeSystemEnvironmentPrivilege	2440	powershell.exe
Token: SeRemoteShutdownPrivilege	2440	powershell.exe
Token: SeUndockPrivilege	2440	powershell.exe
Token: SeManageVolumePrivilege	2440	powershell.exe
Token: 33	2440	powershell.exe
Token: 34	2440	powershell.exe
Token: 35	2440	powershell.exe
Token: 36	2440	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeIncreaseQuotaPrivilege	3180	powershell.exe
Token: SeSecurityPrivilege	3180	powershell.exe
Token: SeTakeOwnershipPrivilege	3180	powershell.exe
Token: SeLoadDriverPrivilege	3180	powershell.exe
Token: SeSystemProfilePrivilege	3180	powershell.exe
Token: SeSystemtimePrivilege	3180	powershell.exe
Token: SeProfSingleProcessPrivilege	3180	powershell.exe
Token: SeIncBasePriorityPrivilege	3180	powershell.exe
Token: SeCreatePagefilePrivilege	3180	powershell.exe
Token: SeBackupPrivilege	3180	powershell.exe
Token: SeRestorePrivilege	3180	powershell.exe
Token: SeShutdownPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeSystemEnvironmentPrivilege	3180	powershell.exe
Token: SeRemoteShutdownPrivilege	3180	powershell.exe
Token: SeUndockPrivilege	3180	powershell.exe
Token: SeManageVolumePrivilege	3180	powershell.exe
Token: 33	3180	powershell.exe
Token: 34	3180	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3060	mspaint.exe
3060	mspaint.exe
3060	mspaint.exe
3060	mspaint.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3700	3584	2026-10-15_44aa72d645a00463e4344dd8aca5f442_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 3700 wrote to memory of 3060	3700	cmd.exe	91
PID 3700 wrote to memory of 3412	3700	cmd.exe	93
PID 3412 wrote to memory of 108	3412	WinUpdate_Helper.exe	94
PID 3412 wrote to memory of 2440	3412	WinUpdate_Helper.exe	100
PID 3412 wrote to memory of 3180	3412	WinUpdate_Helper.exe	102
PID 3412 wrote to memory of 5856	3412	WinUpdate_Helper.exe	104
PID 3412 wrote to memory of 5492	3412	WinUpdate_Helper.exe	106
PID 5492 wrote to memory of 3036	5492	powershell.exe	108
PID 3412 wrote to memory of 948	3412	WinUpdate_Helper.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-15_44aa72d645a00463e4344dd8aca5f442_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_44aa72d645a00463e4344dd8aca5f442_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.bat" "
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\preview.png"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinUpdate_Helper.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinUpdate_Helper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinUpdate_Helper.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\sysupdate.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'sysupdate.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "schtasks /create /tn 'WindowsRuntimeUpdate' /tr '\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\sysupdate.exe\"' /sc onlogon /delay 0000:30 /rl highest /f"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5492
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn WindowsRuntimeUpdate /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\sysupdate.exe" /sc onlogon /delay 0000:30 /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:692

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\sysupdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\sysupdate.exe
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact