Analysis
- max time kernel
151s - max time network
130s - platform
windows7_x64 - resource
win7v200722 - submitted
14/10/2020, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Swift Copy.exe
- Size 490KB
- Sample201014-q2vpaeflke
- SHA256 8ce26cc2fb22fe3d89d7f4bd9ea925f0719ff9208b4e37b1f71b9d4e810bcc0c
- MD5 c7940438819a62c9dd82d206ca4db81f
- SHA1 86100dc4042fad3609e8eff175e1409f1b899eb2
- SHA512 5d5774311cb62deb5035204818d0c4559bfc76daa487d32f5846a2b42e3ccb3690608a37c44fdf3b33994d870433e7fac9ce88ed22fbad5667564df31a230369
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.purebodyrecovery.com/rhk/
Decoy
-
decodemethod.com
-
mamakeyfim.xyz
-
3smokers.com
-
rentaspendirect.com
-
projectstasksjobs.com
-
animedesignetees.com
-
ursthegardennurse.com
-
sunandmoonshirts.com
-
encuentros-es.com
-
nevadahomebirth.com
-
xoxoplants.com
-
tentenos.com
-
anhpham.net
-
beyondtourney.com
-
surfficient.com
-
wannahavedays.online
-
hmyhvgxax.icu
-
holisticskincarecompany.com
-
juggfuckers.com
-
ixgrmz.com
-
chant4yourlife.com
-
clgfzqgw.com
-
pandemiclearningpodsfairfax.com
-
pagmorlormun.com
-
m4ufred.com
-
xn--yaaou-zra.com
-
kai-tan.com
-
letstalkmamahk.com
-
nettbasertutdanning.com
-
phantheon.com
-
sweet-elite.com
-
eyepointph.com
-
hand-madebyrae.com
-
mexikanno.com
-
dunkerque-dentiste.com
-
novusingeniumgroup.com
-
fadin.xyz
-
azmro.com
-
vistaar.world
-
sobrietees.net
-
landschaftstechnik.com
-
roofingguidesite.com
-
betboo507.com
-
fromcelltosell.com
-
amianinfluencer.com
-
grayboxus.com
-
lamnhistudio.com
-
chyjzs.com
-
zhinengjiashiche.com
-
pchcmgrant.com
-
jnyijia.com
-
elementx.agency
-
izhangdong.com
-
topsit.website
-
travelswithsonny.com
-
traceqeisiholdings.com
-
audio-tron.com
-
moonstarinfinity.com
-
dream11exch9.com
-
pocketfieldtrip.com
-
mdsport-eg.com
-
southshoreagles.com
-
275353074.com
-
kgmba.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral1/memory/1316-3-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1316-4-0x000000000041EB10-mapping.dmp formbook behavioral1/memory/1516-11-0x0000000000000000-mapping.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 1504 Swift Copy.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1504 set thread context of 1316 1504 Swift Copy.exe 28 PID 1316 set thread context of 1256 1316 Swift Copy.exe 20 PID 1516 set thread context of 1256 1516 mstsc.exe 20 - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1504 Swift Copy.exe 1316 Swift Copy.exe 1316 Swift Copy.exe 1504 Swift Copy.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe 1516 mstsc.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1316 Swift Copy.exe 1316 Swift Copy.exe 1316 Swift Copy.exe 1516 mstsc.exe 1516 mstsc.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1504 Swift Copy.exe Token: 33 1504 Swift Copy.exe Token: SeIncBasePriorityPrivilege 1504 Swift Copy.exe Token: SeDebugPrivilege 1316 Swift Copy.exe Token: SeDebugPrivilege 1516 mstsc.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1316 1504 Swift Copy.exe 28 PID 1504 wrote to memory of 1316 1504 Swift Copy.exe 28 PID 1504 wrote to memory of 1316 1504 Swift Copy.exe 28 PID 1504 wrote to memory of 1316 1504 Swift Copy.exe 28 PID 1504 wrote to memory of 1316 1504 Swift Copy.exe 28 PID 1504 wrote to memory of 1316 1504 Swift Copy.exe 28 PID 1504 wrote to memory of 1316 1504 Swift Copy.exe 28 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 29 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 29 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 29 PID 1256 wrote to memory of 1516 1256 Explorer.EXE 29 PID 1504 wrote to memory of 1224 1504 Swift Copy.exe 30 PID 1504 wrote to memory of 1224 1504 Swift Copy.exe 30 PID 1504 wrote to memory of 1224 1504 Swift Copy.exe 30 PID 1504 wrote to memory of 1224 1504 Swift Copy.exe 30 PID 1504 wrote to memory of 1616 1504 Swift Copy.exe 32 PID 1504 wrote to memory of 1616 1504 Swift Copy.exe 32 PID 1504 wrote to memory of 1616 1504 Swift Copy.exe 32 PID 1504 wrote to memory of 1616 1504 Swift Copy.exe 32 PID 1616 wrote to memory of 1572 1616 cmd.exe 34 PID 1616 wrote to memory of 1572 1616 cmd.exe 34 PID 1616 wrote to memory of 1572 1616 cmd.exe 34 PID 1616 wrote to memory of 1572 1616 cmd.exe 34 PID 1504 wrote to memory of 1960 1504 Swift Copy.exe 35 PID 1504 wrote to memory of 1960 1504 Swift Copy.exe 35 PID 1504 wrote to memory of 1960 1504 Swift Copy.exe 35 PID 1504 wrote to memory of 1960 1504 Swift Copy.exe 35 PID 1516 wrote to memory of 1988 1516 mstsc.exe 37 PID 1516 wrote to memory of 1988 1516 mstsc.exe 37 PID 1516 wrote to memory of 1988 1516 mstsc.exe 37 PID 1516 wrote to memory of 1988 1516 mstsc.exe 37
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:/Users/Admin/AppData/Local/Temp/Swift Copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Swift Copy.exe" "%temp%\FolderN\name.exe" /Y3⤵PID:1224
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f4⤵PID:1572
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier3⤵
- NTFS ADS
PID:1960
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"3⤵PID:1988
-
-