Analysis
- max time kernel
146s - max time network
144s - platform
windows10_x64 - resource
win10v200722 - submitted
31/08/2020, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
Swift MT-103.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target Swift MT-103.exe
- Size 1.0MB
- Sample200831-ns4293tfe2
- SHA256 f5fdaaa92c4b2a31955e4a21469d2562c2b4be7fb1eae2cd06b5bce77dd25b5e
- MD5 c8b18ed72f85f2254d1621c4aea2b0fe
- SHA1 4389ec0c24dd47818c3410d3fdac6e964bcd082d
- SHA512 770c3943f0759cdd726c3cd7e299c052f82439d3a2d8967c89590f36e0b030e85aebf13a7e700fa5953e2b76be8e1b451e44243b02fb67925ed994e3ba6c4965
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.mansiobok.info/qofh/
Decoy
-
taraandpol.com
-
pure-femjoy.com
-
mdfartsartesanato.com
-
fengyeedu.net
-
ayangbina5.com
-
morebounceorlando.com
-
xiazhefs.com
-
akshaykumar.club
-
kaji-bd.com
-
clearlakefarms.com
-
yifa666888.com
-
gvlfash.com
-
flatwaterenergy.com
-
nvzmae.com
-
perfectwalkpodiatry.com
-
tengfeicarpet.com
-
boxingmediagroup.com
-
chemipartner.com
-
eartuners.com
-
iinoda.net
-
documentusmitte.com
-
print-insights.com
-
segclc.com
-
healingcrystalbling.com
-
sugarcasuals.com
-
dfafluidtransport.com
-
ybyy136.com
-
zhiyizf.com
-
sonriesporguanajuato.com
-
kbad.ltd
-
tarmacsealcoating.com
-
prismasonoro.com
-
crystalforcouncil.nyc
-
tuokeci.com
-
7lbsv2mco.biz
-
ilmioprimobitcoin.com
-
customsbyvos.net
-
zhucaitu.com
-
mriprostatebiopsy.com
-
mr735.com
-
mehdisynthese.com
-
carrecommendation.com
-
lopez.click
-
portaldelassierras.com
-
urgewfs.com
-
diverseofficesolutions.com
-
026manx.com
-
itsy.solutions
-
splitshooting.com
-
www9991684.com
-
whentoski.com
-
lovelifetime.com
-
bimatairports.com
-
kh-bauservice.com
-
hireteawamutu.com
-
inventsonar.win
-
porownywarkafinansowa.online
-
jessbeegood.info
-
girlssupportinggrapes.com
-
beachnoordwijk.com
-
vibraniumrealty.com
-
xn--yfr30sa517obqf.com
-
vipclube.com
-
xungouzj.com
Signatures
- Formbook Payload 4 IoCs
resource yara_rule behavioral2/memory/4060-1-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4060-1-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4060-2-0x000000000041E310-mapping.dmp formbook behavioral2/memory/1880-4-0x0000000000000000-mapping.dmp formbook - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3FAXNZIXM = "C:\\Program Files (x86)\\Eurflc\\qt5pzx4lp.exe" chkdsk.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 508 set thread context of 4060 508 Swift MT-103.exe 73 PID 4060 set thread context of 3052 4060 Swift MT-103.exe 56 PID 1880 set thread context of 3052 1880 chkdsk.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Eurflc\qt5pzx4lp.exe chkdsk.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 7183c320917fd601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 508 Swift MT-103.exe 508 Swift MT-103.exe 4060 Swift MT-103.exe 4060 Swift MT-103.exe 4060 Swift MT-103.exe 4060 Swift MT-103.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 508 Swift MT-103.exe 4060 Swift MT-103.exe 4060 Swift MT-103.exe 4060 Swift MT-103.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe 1880 chkdsk.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 1000 svchost.exe Token: SeCreatePagefilePrivilege 1000 svchost.exe Token: SeDebugPrivilege 4060 Swift MT-103.exe Token: SeDebugPrivilege 1880 chkdsk.exe Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 508 wrote to memory of 4060 508 Swift MT-103.exe 73 PID 508 wrote to memory of 4060 508 Swift MT-103.exe 73 PID 508 wrote to memory of 4060 508 Swift MT-103.exe 73 PID 3052 wrote to memory of 1880 3052 Explorer.EXE 74 PID 3052 wrote to memory of 1880 3052 Explorer.EXE 74 PID 3052 wrote to memory of 1880 3052 Explorer.EXE 74 PID 1880 wrote to memory of 3720 1880 chkdsk.exe 77 PID 1880 wrote to memory of 3720 1880 chkdsk.exe 77 PID 1880 wrote to memory of 3720 1880 chkdsk.exe 77 PID 1880 wrote to memory of 3064 1880 chkdsk.exe 80 PID 1880 wrote to memory of 3064 1880 chkdsk.exe 80 PID 1880 wrote to memory of 3064 1880 chkdsk.exe 80 PID 1880 wrote to memory of 2492 1880 chkdsk.exe 82 PID 1880 wrote to memory of 2492 1880 chkdsk.exe 82 PID 1880 wrote to memory of 2492 1880 chkdsk.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\Swift MT-103.exe"C:\Users\Admin\AppData\Local\Temp\Swift MT-103.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\Swift MT-103.exe"C:\Users\Admin\AppData\Local\Temp\Swift MT-103.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift MT-103.exe"3⤵PID:3720
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3064
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2492
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1000