donutloader | 5b6bd57c7db31237a60f14db705381594d5adb254a08a8f50c85aaeb870e07a4

Analysis

user interaction
yes
max time kernel
149s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fortnite external unsafe.exe
Size 1.4MB
Sample261023-rexptasy4n
SHA256 5b6bd57c7db31237a60f14db705381594d5adb254a08a8f50c85aaeb870e07a4
MD5 9ec3a87b7c509cdd8c49707df6f18ffc
SHA1 4c56c83059c8fffd4c2a50d1413f3f9d18b9453b
SHA512 09bb0d001006336b0d00bd8b0328b68d696ba2a10659f964705086a80bc7aba7abe4bb316482b6bf6144cbecd2ed669a243e24ac8f50512285a958fcd9f31e80
SSDEEP 24576:Cfj5bdof5NBOZBuUUSBaYQj0r95saT1AZzRh6R1giW3npT9:C474Z4dAaYKgDfTYh6tQn
TLSH
T12365E007F3E115B9D06266388952E317E6303C552B24DACF33D92A5C1FA3BE06E76789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3896-0-0x0000029F6A480000-0x0000029F6A4C7000-memory.dmp	family_donutloader

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fortnite external unsafe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fortnite external unsafe.exe

C:\Users\Admin\AppData\Local\Temp\fortnite external unsafe.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite external unsafe.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3896-0-0x0000029F6A480000-0x0000029F6A4C7000-memory.dmp

Download

memory/3896-1-0x0000029F6A560000-0x0000029F6A5A6000-memory.dmp