Analysis
-
max time kernel
63s -
max time network
79s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 11:17
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT 0001.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
SWIFT 0001.exe
Resource
win10
General
-
Target
SWIFT 0001.exe
-
Size
934KB
-
MD5
e946f1d91d436de3ccd079369dd2a37a
-
SHA1
d22298d0b640c75a72014593dca7bad15ded38a7
-
SHA256
6e719e64b4ad2a0d621bdb539d863e62a98845ec70fa5a702a9a21748ec0848a
-
SHA512
de2395a7847b254573737beb7bdce31685d35ff2bed64f0961d49fdf1731e5905bd99ca49411cfbf5cde738389fa136c3d0c3cc98985eaf77de7ae925337351a
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
SWIFT 0001.exepid process 1424 SWIFT 0001.exe -
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SWIFT 0001.exeSWIFT 0001.exepid process 1356 SWIFT 0001.exe 1424 SWIFT 0001.exe 1424 SWIFT 0001.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
SWIFT 0001.exepid process 1356 SWIFT 0001.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SWIFT 0001.exedescription pid process target process PID 1356 set thread context of 1424 1356 SWIFT 0001.exe SWIFT 0001.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SWIFT 0001.exedescription pid process Token: SeDebugPrivilege 1424 SWIFT 0001.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 628 rundll32.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral1/memory/1424-0-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral1/memory/1424-2-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral1/memory/1424-3-0x0000000000400000-0x00000000004A5000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
SWIFT 0001.exeSWIFT 0001.exedescription pid process target process PID 1356 wrote to memory of 1424 1356 SWIFT 0001.exe SWIFT 0001.exe PID 1356 wrote to memory of 1424 1356 SWIFT 0001.exe SWIFT 0001.exe PID 1356 wrote to memory of 1424 1356 SWIFT 0001.exe SWIFT 0001.exe PID 1356 wrote to memory of 1424 1356 SWIFT 0001.exe SWIFT 0001.exe PID 1424 wrote to memory of 628 1424 SWIFT 0001.exe rundll32.exe PID 1424 wrote to memory of 628 1424 SWIFT 0001.exe rundll32.exe PID 1424 wrote to memory of 628 1424 SWIFT 0001.exe rundll32.exe PID 1424 wrote to memory of 628 1424 SWIFT 0001.exe rundll32.exe PID 1424 wrote to memory of 628 1424 SWIFT 0001.exe rundll32.exe PID 1424 wrote to memory of 628 1424 SWIFT 0001.exe rundll32.exe PID 1424 wrote to memory of 628 1424 SWIFT 0001.exe rundll32.exe -
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT 0001.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT 0001.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SWIFT 0001.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT 0001.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\skype3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/628-8-0x0000000000000000-mapping.dmp
-
memory/1424-0-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1424-1-0x00000000004A3800-mapping.dmp
-
memory/1424-2-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1424-3-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1424-4-0x00000000002F0000-0x000000000033C000-memory.dmpFilesize
304KB
-
memory/1424-5-0x00000000002E2000-0x00000000002E3000-memory.dmpFilesize
4KB
-
memory/1424-6-0x0000000000230000-0x0000000000276000-memory.dmpFilesize
280KB