Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 11:17
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT 0001.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
SWIFT 0001.exe
Resource
win10
General
-
Target
SWIFT 0001.exe
-
Size
934KB
-
MD5
e946f1d91d436de3ccd079369dd2a37a
-
SHA1
d22298d0b640c75a72014593dca7bad15ded38a7
-
SHA256
6e719e64b4ad2a0d621bdb539d863e62a98845ec70fa5a702a9a21748ec0848a
-
SHA512
de2395a7847b254573737beb7bdce31685d35ff2bed64f0961d49fdf1731e5905bd99ca49411cfbf5cde738389fa136c3d0c3cc98985eaf77de7ae925337351a
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
123dreams
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SWIFT 0001.exeSWIFT 0001.exepid process 1536 SWIFT 0001.exe 1536 SWIFT 0001.exe 3048 SWIFT 0001.exe 3048 SWIFT 0001.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SWIFT 0001.exedescription pid process target process PID 1536 wrote to memory of 3048 1536 SWIFT 0001.exe SWIFT 0001.exe PID 1536 wrote to memory of 3048 1536 SWIFT 0001.exe SWIFT 0001.exe PID 1536 wrote to memory of 3048 1536 SWIFT 0001.exe SWIFT 0001.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SWIFT 0001.exedescription pid process Token: SeDebugPrivilege 3048 SWIFT 0001.exe -
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Modifies registry class 2 IoCs
Processes:
SWIFT 0001.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings SWIFT 0001.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings OpenWith.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
SWIFT 0001.exepid process 1536 SWIFT 0001.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SWIFT 0001.exedescription pid process target process PID 1536 set thread context of 3048 1536 SWIFT 0001.exe SWIFT 0001.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
SWIFT 0001.exepid process 3048 SWIFT 0001.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 2592 OpenWith.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/3048-0-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral2/memory/3048-2-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral2/memory/3048-3-0x0000000000400000-0x00000000004A5000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT 0001.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT 0001.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\SWIFT 0001.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT 0001.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Modifies registry class
- Suspicious behavior: RenamesItself
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-0-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/3048-1-0x00000000004A3800-mapping.dmp
-
memory/3048-2-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/3048-3-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/3048-4-0x0000000002210000-0x000000000225C000-memory.dmpFilesize
304KB
-
memory/3048-5-0x0000000000532000-0x0000000000533000-memory.dmpFilesize
4KB