Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/10/2026, 04:15
General
- Target SwiftMtc.JS.js
- Size 4.6MB
- Sample261013-evj3fa1sc1
- SHA256 bbb93295a53d22150eef772cc4ab5436e769f97041e741d6377c9373468c03ad
Malware Config
Extracted
-
remcos
-
7.3.1 Pro
-
MEKNKEKUS
-
217.60.195.216:2017
-
77.73.20.105:2017
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-HR3KPM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication 7 IoCs
Network activity triggered a Suricata alert
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 8 IoCs
Network activity triggered a Suricata alert
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 2 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SwiftMtc.JS.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\SwiftMtc.JS.js:Zone.Identifier"2⤵
- Executes a command shell one-liner
- NTFS ADS
-
-
C:\Users\Admin\Documents\UHETQOEXFMNBKCJA.exe"C:\Users\Admin\Documents\UHETQOEXFMNBKCJA.exe" C:\Users\Admin\Documents\AJCKBNMFXEOQTEHU2⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c whoami3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "UHETQOEXFMNBKCJA" 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "UHETQOEXFMNBKCJA"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 10 /tn "UHETQOEXFMNBKCJA" /tr "cmd /c \"C:\Users\Admin\Documents\AJCKBNMFXEOQTEHU.url\"" /ru "zbpjfcbq\admin" /f /it3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 10 /tn "UHETQOEXFMNBKCJA" /tr "cmd /c \"C:\Users\Admin\Documents\AJCKBNMFXEOQTEHU.url\"" /ru "zbpjfcbq\admin" /f /it4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\cmd.execmd1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AJCKBNMFXEOQTEHU
UHETQOEXFMNBKCJA.exe
UHETQOEXFMNBKCJA.mui
memory/1824-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-14-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-55-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-54-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-53-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-52-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-51-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-50-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1824-56-0x0000000016380000-0x0000000017380000-memory.dmp
memory/1824-57-0x0000000002D10000-0x0000000002DBF000-memory.dmp
memory/1824-58-0x0000000000400000-0x000000000047B000-memory.dmp