a05377124fe9f9a262ddb1b58d2eac7556299ec686bf5c2f005bd4792131a3c8

Analysis

max time kernel
67s
max time network
69s
platform
windows10_x64
resource
win10v200722
submitted
07/08/2020, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SWIFT_30032131300221547_0029938344.exe
Size 1021KB
Sample200807-748hpcdvt2
SHA256 a05377124fe9f9a262ddb1b58d2eac7556299ec686bf5c2f005bd4792131a3c8
MD5 224dfa794a92c3129e790f211bc1fe37
SHA1 735ea8cd7357f40216da74736e65a0159b4c7fd7
SHA512 49fe47f66fb4a21c2d21f9161462968181984213deef7c759fec6bc6852bca05f8fa6a92c02bf5437732eb4db1c63ad2bd4320ff631faff6678a56d74414fc39
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	SWIFT_30032131300221547_0029938344.exe
Token: SeDebugPrivilege	3344	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3740	SWIFT_30032131300221547_0029938344.exe
3740	SWIFT_30032131300221547_0029938344.exe
3740	SWIFT_30032131300221547_0029938344.exe
3740	SWIFT_30032131300221547_0029938344.exe
3740	SWIFT_30032131300221547_0029938344.exe
3344	powershell.exe
3344	powershell.exe
3344	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 2676	3740	SWIFT_30032131300221547_0029938344.exe	72
PID 3740 wrote to memory of 2676	3740	SWIFT_30032131300221547_0029938344.exe	72
PID 3740 wrote to memory of 2676	3740	SWIFT_30032131300221547_0029938344.exe	72
PID 3740 wrote to memory of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73
PID 3740 wrote to memory of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73
PID 3740 wrote to memory of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73
PID 3740 wrote to memory of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73
PID 3740 wrote to memory of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73
PID 3740 wrote to memory of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73
PID 3740 wrote to memory of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73
PID 3740 wrote to memory of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73
PID 2684 wrote to memory of 3944	2684	SWIFT_30032131300221547_0029938344.exe	75
PID 2684 wrote to memory of 3944	2684	SWIFT_30032131300221547_0029938344.exe	75
PID 2684 wrote to memory of 3944	2684	SWIFT_30032131300221547_0029938344.exe	75
PID 3944 wrote to memory of 3344	3944	cmd.exe	77
PID 3944 wrote to memory of 3344	3944	cmd.exe	77
PID 3944 wrote to memory of 3344	3944	cmd.exe	77

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3740 set thread context of 2684	3740	SWIFT_30032131300221547_0029938344.exe	73

Deletes itself 1 IoCs

pid	Process
3344	powershell.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT_30032131300221547_0029938344.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT_30032131300221547_0029938344.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3740
- C:\Users\Admin\AppData\Local\Temp\SWIFT_30032131300221547_0029938344.exe
  "{path}"
  2⤵
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\SWIFT_30032131300221547_0029938344.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\SWIFT_30032131300221547_0029938344.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\SWIFT_30032131300221547_0029938344.exe'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious behavior: EnumeratesProcesses
      Deletes itself
      PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-10-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/2684-20-0x0000000005BA0000-0x0000000005BAF000-memory.dmp

Download

memory/2684-18-0x00000000057A0000-0x00000000057A1000-memory.dmp

Download

memory/2684-17-0x0000000005720000-0x0000000005791000-memory.dmp

Download

memory/2684-12-0x0000000073D90000-0x000000007447E000-memory.dmp

Download

memory/3344-31-0x0000000008200000-0x0000000008201000-memory.dmp

Download

memory/3344-33-0x0000000008A60000-0x0000000008A61000-memory.dmp

Download

memory/3344-38-0x0000000007480000-0x0000000007481000-memory.dmp

Download

memory/3344-37-0x00000000099F0000-0x00000000099F1000-memory.dmp

Download

memory/3344-36-0x0000000009610000-0x0000000009611000-memory.dmp

Download

memory/3344-35-0x000000000A070000-0x000000000A071000-memory.dmp

Download

memory/3344-34-0x0000000008880000-0x0000000008881000-memory.dmp

Download

memory/3344-32-0x0000000008610000-0x0000000008611000-memory.dmp

Download

memory/3344-29-0x0000000007F40000-0x0000000007F41000-memory.dmp

Download

memory/3344-28-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

Download

memory/3344-25-0x0000000073E10000-0x00000000744FE000-memory.dmp

Download

memory/3344-26-0x0000000007170000-0x0000000007171000-memory.dmp

Download

memory/3344-27-0x0000000007800000-0x0000000007801000-memory.dmp

Download

memory/3740-1-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/3740-0-0x0000000073D90000-0x000000007447E000-memory.dmp

Download

memory/3740-3-0x0000000005F40000-0x0000000005F41000-memory.dmp

Download

memory/3740-9-0x000000000AB30000-0x000000000ABF0000-memory.dmp

Download

memory/3740-4-0x0000000005990000-0x0000000005991000-memory.dmp

Download

memory/3740-5-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/3740-6-0x0000000005ED0000-0x0000000005ED8000-memory.dmp

Download

memory/3740-7-0x0000000007DE0000-0x0000000007DE1000-memory.dmp

Download

memory/3740-8-0x00000000082F0000-0x00000000083B1000-memory.dmp

Download