Deceptively Sweet: DonutLoader Reloaded in a modern Remcos RAT Infection

The PowerShell script downloads three additional files, legitimate 7Zip components (7z.exe and 7z.dll), and  a password-protected iphdcrtj.zip from the cloud storage service pCloud (filedn[.]com),  serving two primary objectives.  

First, it ensures reliability of executing the infection in different Windows environments. By bundling its own tools, it reduces the reliance of locally installed utilities and mitigates potential execution failure due to lack of dependencies or restricted configurations. Second, password-protected files slows initial static inspection by requiring extraction prior to analysis and prevent file hosting services from catching malwares on their system. 

Looking at the decoded PowerShell script, the structure and formatting of the commands used were unusually consistent. The presence of the code comments is something not typically seen in manually written malicious scripts. These characteristics suggest that the script may have been generated or refined using AI-assisted tools, which have become increasingly common in script development. 

The downloaded password-protected archive file named iphdcrtj.zip contains a malicious JScript named iphdcrtj.js, which is dropped in the C:\Users\Public directory. This script is obfuscated, it contains junk strings to hinder static analysis. It drops two files. One is an AutoIt3 interpreter version 3.3.16.1 and the other a fake PNG image file.  

The dropped AutoIt interpreter is then executed by the iphdcrtj.js to process the embedded data stored within the fake PNG file. Although the PNG appears to be a benign image file, it is an AutoIt script which contains encoded strings and API definitions that are extracted and decrypted at runtime. The embedded decoding routine uses a single-byte XOR with the constant key 0x63. The recovered data reveals multiple data structures and Windows API functions commonly used in process injection.  

These data structures and APIs are used to dynamically reconstruct the next-stage payload in memory for injection into colorcpl.exe, the legitimate Windows Color Management utility.  

This infection highlights the consistent reliance of Remcos RAT on techniques where payloads are decoded, staged and executed directly in memory during runtime.  The use of multiple scripting layers such as PowerShell, VBScript and native Windows utilities suggests that this iteration of RemcosRAT is designed with stealth and operational flexibility in mind. Another consistent characteristic that warrants special attention is the extensive use of LOLBins. Legitimate Windows utilities are leveraged for proxy and in-memory execution evading early detection and blending malicious activity with normal system behavior. 

Once successfully deployed, Remcos RAT functions as a full-featured Remote Access Trojan (RAT) that establishes communication with an attacker-controlled command-and-control (C2) server. After the connection is established, operators can remotely control the compromised host, execute commands, manage files, capture screenshots, log keystrokes, harvest credentials, activate webcams or microphones and deploy additional payloads.  These capabilities were extensively documented and analyzed by Fortinet in its recent research on modern Remcos RAT activity. 

While there are already clear similarities existing across Remcos RAT campaigns, this analysis reveals newer techniques incorporated. The introduction of shellcode for process injection generated by DonutLoader has not been widely observed in Remcos RAT  infections prior to this activity. This suggests an evolving and continuous refinement of Remcos RAT’s evasion and execution methods.