Analysis
- max time kernel
40s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
27/08/2026, 09:50
General
- Target August20Due20invoives20payment20advice20250826YHUJ.js
- Size 5.4MB
- Sample260827-ltwheaseqh
- SHA256 c35b38ddab1c5d4da4a94baaf3b845e4d35f01f9522f1df8d7e8bbd8990ee8c2
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication 3 IoCs
Network activity triggered a Suricata alert
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 5 IoCs
Network activity triggered a Suricata alert
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\August20Due20invoives20payment20advice20250826YHUJ.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\YXFMZXKELXMJBTRT.PIF"C:\Users\Admin\Documents\YXFMZXKELXMJBTRT.PIF" C:\Users\Admin\Documents\YXFMZXKELXMJBTRT.ttf2⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
YXFMZXKELXMJBTRT.PIF
YXFMZXKELXMJBTRT.ttf
memory/6028-9-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-15-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-14-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-16-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-55-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-54-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-72-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-71-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-70-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-69-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-68-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-67-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-66-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-65-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-64-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-63-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-62-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-61-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-60-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-58-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-53-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-52-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-51-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-50-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-59-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-56-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-57-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/6028-314-0x0000000015AA0000-0x0000000015B49000-memory.dmp
memory/6028-319-0x0000000180000000-0x000000018012C000-memory.dmp
memory/6028-321-0x0000000180000000-0x000000018012C000-memory.dmp