Analysis
- max time kernel
147s - max time network
140s - platform
windows10_x64 - resource
win10 - submitted
06/10/2020, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT TRANSFER.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target SWIFT TRANSFER.exe
- Size 490KB
- Sample201006-2kfym1f1qn
- SHA256 ec4ee2fa916e9fc280f06af0ceded7835693723ebbc6c60bd6e371b5d4ad006a
- MD5 b66ea2403a923c0105ad0559e9f6e53b
- SHA1 c4864e857f383ad6535009a04f5e3b4a7d74e1dc
- SHA512 6938636c4d34c56d33ceba2d0091e79fdf60dc09541a9d535b4117936d4b100ebd01ea0f31aab39e1a289259ffb5954acf54b6b78129a0eef881c2e683b0fc6b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.purebodyrecovery.com/rhk/
Decoy
-
decodemethod.com
-
mamakeyfim.xyz
-
3smokers.com
-
rentaspendirect.com
-
projectstasksjobs.com
-
animedesignetees.com
-
ursthegardennurse.com
-
sunandmoonshirts.com
-
encuentros-es.com
-
nevadahomebirth.com
-
xoxoplants.com
-
tentenos.com
-
anhpham.net
-
beyondtourney.com
-
surfficient.com
-
wannahavedays.online
-
hmyhvgxax.icu
-
holisticskincarecompany.com
-
juggfuckers.com
-
ixgrmz.com
-
chant4yourlife.com
-
clgfzqgw.com
-
pandemiclearningpodsfairfax.com
-
pagmorlormun.com
-
m4ufred.com
-
xn--yaaou-zra.com
-
kai-tan.com
-
letstalkmamahk.com
-
nettbasertutdanning.com
-
phantheon.com
-
sweet-elite.com
-
eyepointph.com
-
hand-madebyrae.com
-
mexikanno.com
-
dunkerque-dentiste.com
-
novusingeniumgroup.com
-
fadin.xyz
-
azmro.com
-
vistaar.world
-
sobrietees.net
-
landschaftstechnik.com
-
roofingguidesite.com
-
betboo507.com
-
fromcelltosell.com
-
amianinfluencer.com
-
grayboxus.com
-
lamnhistudio.com
-
chyjzs.com
-
zhinengjiashiche.com
-
pchcmgrant.com
-
jnyijia.com
-
elementx.agency
-
izhangdong.com
-
topsit.website
-
travelswithsonny.com
-
traceqeisiholdings.com
-
audio-tron.com
-
moonstarinfinity.com
-
dream11exch9.com
-
pocketfieldtrip.com
-
mdsport-eg.com
-
southshoreagles.com
-
275353074.com
-
kgmba.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/636-5-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/636-6-0x000000000041EB10-mapping.dmp formbook behavioral2/memory/1308-12-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3012 set thread context of 636 3012 SWIFT TRANSFER.exe 73 PID 636 set thread context of 2988 636 SWIFT TRANSFER.exe 56 PID 1308 set thread context of 2988 1308 svchost.exe 56 - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3012 SWIFT TRANSFER.exe 636 SWIFT TRANSFER.exe 636 SWIFT TRANSFER.exe 3012 SWIFT TRANSFER.exe 636 SWIFT TRANSFER.exe 636 SWIFT TRANSFER.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 636 SWIFT TRANSFER.exe 636 SWIFT TRANSFER.exe 636 SWIFT TRANSFER.exe 1308 svchost.exe 1308 svchost.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3012 SWIFT TRANSFER.exe Token: 33 3012 SWIFT TRANSFER.exe Token: SeIncBasePriorityPrivilege 3012 SWIFT TRANSFER.exe Token: SeDebugPrivilege 636 SWIFT TRANSFER.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeDebugPrivilege 1308 svchost.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3012 wrote to memory of 636 3012 SWIFT TRANSFER.exe 73 PID 3012 wrote to memory of 636 3012 SWIFT TRANSFER.exe 73 PID 3012 wrote to memory of 636 3012 SWIFT TRANSFER.exe 73 PID 3012 wrote to memory of 636 3012 SWIFT TRANSFER.exe 73 PID 3012 wrote to memory of 636 3012 SWIFT TRANSFER.exe 73 PID 3012 wrote to memory of 636 3012 SWIFT TRANSFER.exe 73 PID 3012 wrote to memory of 3168 3012 SWIFT TRANSFER.exe 74 PID 3012 wrote to memory of 3168 3012 SWIFT TRANSFER.exe 74 PID 3012 wrote to memory of 3168 3012 SWIFT TRANSFER.exe 74 PID 3012 wrote to memory of 424 3012 SWIFT TRANSFER.exe 76 PID 3012 wrote to memory of 424 3012 SWIFT TRANSFER.exe 76 PID 3012 wrote to memory of 424 3012 SWIFT TRANSFER.exe 76 PID 424 wrote to memory of 1236 424 cmd.exe 78 PID 424 wrote to memory of 1236 424 cmd.exe 78 PID 424 wrote to memory of 1236 424 cmd.exe 78 PID 2988 wrote to memory of 1308 2988 Explorer.EXE 79 PID 2988 wrote to memory of 1308 2988 Explorer.EXE 79 PID 2988 wrote to memory of 1308 2988 Explorer.EXE 79 PID 3012 wrote to memory of 1304 3012 SWIFT TRANSFER.exe 80 PID 3012 wrote to memory of 1304 3012 SWIFT TRANSFER.exe 80 PID 3012 wrote to memory of 1304 3012 SWIFT TRANSFER.exe 80 PID 1308 wrote to memory of 2716 1308 svchost.exe 84 PID 1308 wrote to memory of 2716 1308 svchost.exe 84 PID 1308 wrote to memory of 2716 1308 svchost.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\SWIFT TRANSFER.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT TRANSFER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\SWIFT TRANSFER.exe"C:/Users/Admin/AppData/Local/Temp/SWIFT TRANSFER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/SWIFT TRANSFER.exe" "%temp%\FolderN\name.exe" /Y3⤵PID:3168
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f3⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f4⤵PID:1236
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier3⤵
- NTFS ADS
PID:1304
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SWIFT TRANSFER.exe"3⤵PID:2716
-
-