donutloader | 03a797ad0aaed4eaf6ffaac64f631c5f56217d5c8ed3554d21f8c270f067818b

Resubmissions

02/11/2026, 05:53

261102-glpyfahv6p10

02/11/2026, 05:48

261102-ghnk7se17z10

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
seuaniversario.js
Size 3.4MB
Sample261102-glpyfahv6p
SHA256 03a797ad0aaed4eaf6ffaac64f631c5f56217d5c8ed3554d21f8c270f067818b
MD5 07464b7d1ca1d25bb007f200b806d2f1
SHA1 ded43fa88174998dd6fa0687aca70149a9f19e9c
SHA512 4745c99fc9c538097f55b03bbbb8f9b8e468002c1a7d8163ea82fcbd99e907bda5b2a45f51fd525af53b71a5337853911ebc594ab43c7dde8ebee9c66058505a
SSDEEP 49152:yh7AfjNdciMOruxFCpVKATdBSE0oTJeKw7U:cM
TLSH
T1FCF5F1C0DA660F5E360C726AAA3BCD9BC821C5865875927069FC708B379C051D4FDEBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence privilege_escalation

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4392-15-0x0000000000540000-0x000000000055E000-memory.dmp	family_donutloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\seuaniversario.lnk	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4964	cykypemm.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
408	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4484	cmd.exe
508	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cykypemm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexpress.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4484	cmd.exe
508	cmd.exe
5092	PING.EXE
3224	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5092	PING.EXE
3224	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	iexpress.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4964	2444	wscript.exe	85
PID 4964 wrote to memory of 4392	4964	cykypemm.exe	86
PID 4964 wrote to memory of 4392	4964	cykypemm.exe	86
PID 2444 wrote to memory of 408	2444	wscript.exe	92
PID 2444 wrote to memory of 4484	2444	wscript.exe	93
PID 2444 wrote to memory of 508	2444	wscript.exe	95
PID 4484 wrote to memory of 3224	4484	cmd.exe	97
PID 508 wrote to memory of 5092	508	cmd.exe	98

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\seuaniversario.js
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Roaming\ProtectedData\cykypemm.exe
  "C:\Users\Admin\AppData\Roaming\ProtectedData\cykypemm.exe" "C:\Users\Admin\AppData\Roaming\ProtectedData\gywhlmku.au3"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\iexpress.exe
    C:\Windows\SysWOW64\iexpress.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ProtectedData\mopeudpb.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\seuaniversario.js"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 9 127.0.0.1 >nul & rd /s /q "C:\Users\Admin\AppData\Roaming\ProtectedData"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:508
- - C:\Windows\system32\PING.EXE
    ping -n 9 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5092

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SEUANI~1.JS

Path C:\Users\Admin\AppData\Roaming\ProtectedData\SEUANI~1.JS
Size 3.4MB
SHA256 03a797ad0aaed4eaf6ffaac64f631c5f56217d5c8ed3554d21f8c270f067818b
MD5 07464b7d1ca1d25bb007f200b806d2f1
SHA1 ded43fa88174998dd6fa0687aca70149a9f19e9c
SHA512 4745c99fc9c538097f55b03bbbb8f9b8e468002c1a7d8163ea82fcbd99e907bda5b2a45f51fd525af53b71a5337853911ebc594ab43c7dde8ebee9c66058505a
SSDEEP 49152:yh7AfjNdciMOruxFCpVKATdBSE0oTJeKw7U:cM
TLSH
T1FCF5F1C0DA660F5E360C726AAA3BCD9BC821C5865875927069FC708B379C051D4FDEBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cykypemm.exe

Path C:\Users\Admin\AppData\Roaming\ProtectedData\cykypemm.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gywhlmku.au3

Path C:\Users\Admin\AppData\Roaming\ProtectedData\gywhlmku.au3
Size 8KB
SHA256 ecb6e3a8d13789e9a6dca89b24c3476b6fc5f8c3dd48932df2057061f78d6267
MD5 a3be50ff28c8296a978cbc0b63e2e9a9
SHA1 be209171e07a37ed6dd0ee6a136e47ca3daea264
SHA512 b0f9ee7e6c39230cdbdced02c260c2b708bfca71d3a685deb479a2d5dd8048a997ce751715e153a30e17124fa9af1b823d55f58b7b33667649a220b893103ca2
SSDEEP 96:We09ze09zIc/bVGCGIGIGIGIGIGIGIGNNMJJKv+05JFGIGVHaG5wGUrGKGsbWaUW:aMk+OVk
TLSH
T150022DC85E56BFFCDBC2C8964B4DDB4980E029AA5B3480E5E639F40C407B5BD1AC75A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qaqq

Path C:\Users\Admin\AppData\Roaming\ProtectedData\qaqq
Size 119KB
SHA256 9712c0e58292342b415db7e284f5805e29c32095b1680d6de2c56e4bc63089d5
MD5 8e9358135317160833dc39d1933d77a7
SHA1 f0e787d77ac0430315303feae580bcbc51056776
SHA512 75edabb98a0a84d1d6f3f543bd9248ac4788ca5e457001ad9b262f7b9798997ffa93b8c54265c6057c12434494d24aea04d022053910d700492678373f1c9bdf
SSDEEP 3072:Xh+mPVF+3OYTKdv3B/UZzN8oodKiHvzn05rpHh:Xh+Y+xav3RUZzOxdjHb05tB
TLSH
T17DC312F1AA0E2C22BB0B0FF891A46A739D864D9A5DFE20D0EAC6181C8547716DFD9461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4392-15-0x0000000000540000-0x000000000055E000-memory.dmp

Download

memory/4392-17-0x0000000005460000-0x000000000547C000-memory.dmp

Download

memory/4392-22-0x0000000005C80000-0x0000000005D1C000-memory.dmp

Download

memory/4392-23-0x00000000062D0000-0x0000000006874000-memory.dmp

Download

memory/4392-24-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/4392-26-0x0000000006920000-0x00000000069B2000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads