Overview

overview

10

Static

static

3

zra091jn.exe

windows10-2004-x64

10

zra091jn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    162s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 22:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    zra091jn.exe
  • Size 66.7MB
  • Sample261110-2p2rmaca86
  • SHA256 eddbb7f87f6c3fd788f5aa002bf8ff5bf75cbdef2cced815cd412807a655168d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
donutloaderloaderpersistence

Malware Config

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Detects DonutLoader 2 IoCs
    loader
  • Loads dropped DLL 24 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Users\Admin\AppData\Local\Temp\zra091jn.exe
      "C:\Users\Admin\AppData\Local\Temp\zra091jn.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\zra091jn.exe
        "C:\Users\Admin\AppData\Local\Temp\zra091jn.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4276

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\PyQt6\Qt6\bin\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\PyQt6\Qt6\bin\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\PyQt6\Qt6\bin\Qt6Core.dll
        • Size 9.6MB
        • SHA256 0b0474bfb1d3465a597a51cd383d9c7d502f4b5e15f66b09956390c33ac406ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\PyQt6\Qt6\bin\VCRUNTIME140_1.dll
        • Size 43KB
        • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qtmultimedia_en.qm
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\PyQt6\Qt6\translations\qtmultimedia_en.qm
        • Size 33B
        • SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
        • MD5 SHA1 SHA512
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\PyQt6\QtCore.pyd
        • Size 2.4MB
        • SHA256 5f24ce426fa4f2e4f7d0987ad136a95d09fa244e13408b5287e5895bd76d56c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\PyQt6\sip.cp312-win_amd64.pyd
        • Size 108KB
        • SHA256 4f9b530b045d07007b2bda07580c0ef031a973b8ebd577ae9f533fe52e2bb894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\_bz2.pyd
        • Size 84KB
        • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\_ctypes.pyd
        • Size 124KB
        • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\_hashlib.pyd
        • Size 67KB
        • SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\_lzma.pyd
        • Size 157KB
        • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\_queue.pyd
        • Size 32KB
        • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\_socket.pyd
        • Size 83KB
        • SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\_ssl.pyd
        • Size 175KB
        • SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\_wmi.pyd
        • Size 39KB
        • SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\base_library.zip
        • Size 1.3MB
        • SHA256 8d6420c5a9f114ee99a46745f4cfcfe433ab54d6472a95e0710aa0827cd7f1ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\libssl-3.dll
        • Size 776KB
        • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\pyexpat.pyd
        • Size 200KB
        • SHA256 d615e193d1affcdbfe504e90d3621cbdcff94bf72b79d899126534507fd6d27a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\python3.DLL
        • Size 68KB
        • SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\python312.dll
        • Size 6.6MB
        • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\select.pyd
        • Size 32KB
        • SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34362\slip10-1.1.0.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        memory/808-705-0x0000000002D30000-0x0000000002D50000-memory.dmp
        Download

        memory/808-704-0x00000000013D0000-0x00000000013F4000-memory.dmp
        Download

        memory/808-708-0x0000000003D30000-0x0000000003D31000-memory.dmp
        Download

        memory/3436-709-0x00007FF6BBE60000-0x00007FF6BBE9B000-memory.dmp
        Download

        memory/4276-682-0x00007FFA19640000-0x00007FFA198B3000-memory.dmp
        Download

        memory/4276-707-0x00007FF6BBE60000-0x00007FF6BBE9B000-memory.dmp
        Download

        memory/4276-703-0x000002AA9CD10000-0x000002AA9CD5A000-memory.dmp
        Download

        memory/4276-702-0x000002AA9CC30000-0x000002AA9CC7B000-memory.dmp
        Download