Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
23/06/2026, 08:27
General
- Target _854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6.js
- Size 2.9MB
- Sample260623-kctf2sbt2j
- SHA256 854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6
Malware Config
Extracted
-
xworm
-
5.0
-
104.239.66.178:7004
-
2G6NAUlbrAzlRZde
-
install_file
USB.exe
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 2 IoCs
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\_854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\CZPAQWCXGYDDVXAJ.PIF"C:\Users\Admin\Documents\CZPAQWCXGYDDVXAJ.PIF" C:\Users\Admin\Documents\CZPAQWCXGYDDVXAJ.ttf2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CZPAQWCXGYDDVXAJ.PIF
CZPAQWCXGYDDVXAJ.ttf
memory/3944-9-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-15-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-14-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-16-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-51-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-50-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/3944-53-0x00000000147C0000-0x00000000147D0000-memory.dmp
memory/3944-52-0x00000000147C0000-0x00000000157C0000-memory.dmp
memory/3944-54-0x00007FFF1983F000-0x00007FFF19840000-memory.dmp
memory/3944-55-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/3944-56-0x0000000026720000-0x000000002672E000-memory.dmp
memory/3944-57-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/3944-58-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/3944-59-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
memory/3944-60-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3944-61-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp