Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 10:01
General
- Target SWIFT_COPY (79).js
- Size 253KB
- Sample260424-l2evmaft6q
- SHA256 03e9edb515412195e54b9547d0549f05fe31c25180cf82b7b3ba7872d44daf3f
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SWIFT_COPY (79).js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -W H -noP -NoNi -EP ByPASS -Command "iex $env:6txBWTXfvSty"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -W H -noP -NoNi -EP ByPASS -Command "iex $env:6txBWTXfvSty"3⤵
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe4⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Windows Update Service" dir=out action=allow program="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" enable=yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Windows Update Service Host" dir=in action=allow program="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" enable=yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\wifi_profiles.tmp"5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tzp3jly5.ehw.ps1
rsql_4396_240697812.tmp
rsql_4396_240697828.tmp
wifi_profiles.tmp
memory/2824-1-0x000001E596C80000-0x000001E596C8C000-memory.dmp
memory/2824-0-0x000001E596C20000-0x000001E596C75000-memory.dmp
memory/4396-50-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-35-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-16-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-18-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-72-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-76-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-79-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-82-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-19-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-17-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-27-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-28-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-30-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-32-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-31-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-33-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-34-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-42-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-37-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-38-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-36-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-22-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-41-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-43-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-44-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-46-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-45-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-47-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-48-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-49-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-23-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-51-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-83-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-54-0x0000025D70DB0000-0x0000025D70E05000-memory.dmp
memory/4396-52-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-55-0x0000025D72850000-0x0000025D72858000-memory.dmp
memory/4396-56-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-57-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-58-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-53-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-60-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-61-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-59-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-62-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-63-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-64-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-65-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-66-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-68-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-67-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-70-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-71-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-73-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-74-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-75-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-77-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-78-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-80-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4396-81-0x0000000140000000-0x0000000140576000-memory.dmp
memory/4568-3-0x0000029CD2410000-0x0000029CD2420000-memory.dmp
memory/4568-25-0x0000029CB82F0000-0x0000029CB82FC000-memory.dmp
memory/4568-26-0x0000029CD2390000-0x0000029CD2398000-memory.dmp
memory/4568-13-0x0000029CD22D0000-0x0000029CD22DE000-memory.dmp
memory/4568-12-0x0000029CD2340000-0x0000029CD2382000-memory.dmp
memory/4568-9-0x0000029CD22E0000-0x0000029CD2302000-memory.dmp
memory/4568-2-0x0000029CD2410000-0x0000029CD2420000-memory.dmp
memory/4568-24-0x0000029CB8270000-0x0000029CB82C5000-memory.dmp