donutloader | 0937ea0290c49df8defeb9056dd0e1f700e4e40f056b9bc9af6577f0f8ea0a1e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 392KB
Sample261018-eyrxfsgs6p
SHA256 0937ea0290c49df8defeb9056dd0e1f700e4e40f056b9bc9af6577f0f8ea0a1e
MD5 a08d7d3119fb3066415fac3f10c23dc8
SHA1 3629bddce8c1aad7b80be03c8c8dd712a403f3bf
SHA512 a217b4c5784d75d9a1026e9d63688c7c1c4c1d65679c8a56c7e8ab6654f37fbaacb21eb0adb826ba8c7252678c6df042fedfba8eeafdd9db852cfd32b56ee558
SSDEEP 12288:sprL18EdcV2A4QQ4XmcLSVqd7O/ie2yg:wjq2PQvOJ2y
TLSH
T1C8843B1BE69655E8C117D07883AFE373A831B8180234BE5F1B94DF323F61A605B6E719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader loader persistence spyware trojan

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4320-16-0x0000023A37BB0000-0x0000023A37C5C000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
468	file.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	file.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100000b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	file.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
PID:4320

C:\Users\Admin\AppData\Local\RarUtils\utils\file.exe
C:\Users\Admin\AppData\Local\RarUtils\utils\file.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 69b4a98b24989e60750b39c7b343e3878b434c960d811bfe21307190e20e41bc
MD5 e51e8cf84ad6762b7e82b7c7a2de2f8c
SHA1 7554a05ca2a4e98069fdcf58d862e10fc7f69699
SHA512 d10322a26d2a5a3d3942749c14a56f6cf7f0b4a8a9271c20070cf69a00f79fde6dd9c1c42e1d3f449e530a4d553801cfad65911d1a40cfeebe048ca0d569ee8a
TLSH
T12F31C7BF1BAD3C864F6A4DE124CAB0312DB0E1806CC500976264E4944F043F61E6990C
MD5 SHA1 SHA512 TLSH

Submit Download

28C81CFCC3DD90CD1C4BDD9F7D65443C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\28C81CFCC3DD90CD1C4BDD9F7D65443C
Size 331KB
SHA256 af095c46ff06c8d5b7b01a15f6bed2eed8351fa14b872919017898dcf68e2151
MD5 dbf2a80452c58ae4346681d1a2a6f7a1
SHA1 643acd1211b5e0bf5070e365b99ccf74ad231229
SHA512 2a7ced152c00d45f20d2a3d00cb861a72f44806016af0df62c1ffad464e4845ddd0e6d9057e1f998b97bd32fc73003e2d1eecedddc04a69fc7701bd7e512f30d
SSDEEP 3072:BOj4WREwsaA+HdDlnfOw/KNXiTCCZI9NIv8lrCyH6DgZR:BOj4yDsgxD/LTJv8d15ZR
TLSH
T18D74D91C1164B2739A05AB70C8D79DD7EDF1A79A1399E01E86A15F460021FEB8FD32E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

949D2E01833511C6366A8B529939FE66_E80B95907B62816351718DBAEA6F9F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\949D2E01833511C6366A8B529939FE66_E80B95907B62816351718DBAEA6F9F40
Size 314B
SHA256 9d537b91971ca1761867866b7957ba54f62685921b84a687a0d8c773b505f04d
MD5 827bde1aecce79f19ba52a0d187ca205
SHA1 a482e8728f32d96e9d938fdd2861fa54688ceef2
SHA512 bb56c76d2bf20035f77b72fd45fd8e199a72cd8dd383fe906e21d4ed3cc56dd99fee1e03a926054726b433c1021387fb9918676e9ea4a045eadafd8c17853589
TLSH
T1CDE07D54C4D118596D40FF44C4E7832D75F605A841C3223C74DC879421B69798B54854
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 1305725953578c0361c14f2cfd3273c256f881e898015e0570672669f03ca6b2
MD5 1278c8d32de879c8d5429becd0f11f41
SHA1 0084fb6c4b3d7331e3c6584f627b7792bdeef046
SHA512 6ea63c999dc035d5a020571dbecf0ee5b8d5f45afba4babca653bb8fb86f43387151c84c2e057a634785f05e1c2a294dcd30e65a7eb82c7a8f62fde108724e16
TLSH
T1DFE026041979412DF431CE3E9ACE79A7176EE216340A03F01BE45709B74AA413D52DB0
MD5 SHA1 SHA512 TLSH

Submit Download

28C81CFCC3DD90CD1C4BDD9F7D65443C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\28C81CFCC3DD90CD1C4BDD9F7D65443C
Size 192B
SHA256 5ba1e27ad1c031bbe13ea560a205f6a701fcbb1c886e905d29f441648a8323d6
MD5 144778eef7c9661837f560f134fc0c3b
SHA1 79a26fea23b4a7080f7ac942c82b83660e726345
SHA512 9c602b89526b2014d3146e9a76ef633734ed06ebc1e7454e938613d47008f772ae036e6530487f3d63b13f946ea809df3ad20877b192a020ee68259fd5b33706
TLSH
T1DBC08010F6154118F255257ECDD1369207F48609D152C7900BF00557551D9515C20D15
MD5 SHA1 SHA512 TLSH

Submit Download

949D2E01833511C6366A8B529939FE66_E80B95907B62816351718DBAEA6F9F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\949D2E01833511C6366A8B529939FE66_E80B95907B62816351718DBAEA6F9F40
Size 486B
SHA256 ef527a7e84f6a15f81bd2a73867344022f45e0b9b10a233952a35557d809667a
MD5 b7f1fca4a1566f46322468f39252cbf0
SHA1 7075fcc36a42c7f728cfb1d22bd2c79f937498df
SHA512 0aad19e14631051e8324a50adec87abb1095c4dd7d7b68da6d902f32036f78b5a90b7bcc372b7731c84de04abe235b25eea69e87472ec6ed1a7511cc26d65065
TLSH
T18DF0A36805FB402EE035DDBAC9F192319D55F1B33C08577E16D19615B513F01EE32530
MD5 SHA1 SHA512 TLSH

Submit Download

file.exe

Path C:\Users\Admin\AppData\Local\RarUtils\utils\file.exe
Size 392KB
SHA256 0937ea0290c49df8defeb9056dd0e1f700e4e40f056b9bc9af6577f0f8ea0a1e
MD5 a08d7d3119fb3066415fac3f10c23dc8
SHA1 3629bddce8c1aad7b80be03c8c8dd712a403f3bf
SHA512 a217b4c5784d75d9a1026e9d63688c7c1c4c1d65679c8a56c7e8ab6654f37fbaacb21eb0adb826ba8c7252678c6df042fedfba8eeafdd9db852cfd32b56ee558
SSDEEP 12288:sprL18EdcV2A4QQ4XmcLSVqd7O/ie2yg:wjq2PQvOJ2y
TLSH
T1C8843B1BE69655E8C117D07883AFE373A831B8180234BE5F1B94DF323F61A605B6E719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-21-0x000002AB60DA0000-0x000002AB60E4C000-memory.dmp

Download

memory/468-23-0x00007FF70C530000-0x00007FF70C599000-memory.dmp

Download

memory/4320-16-0x0000023A37BB0000-0x0000023A37C5C000-memory.dmp

Download

memory/4320-19-0x0000023A37D50000-0x0000023A37DFC000-memory.dmp

Download

memory/4320-22-0x00007FF628470000-0x00007FF6284D9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads