Analysis
- max time kernel
149s - max time network
140s - platform
windows10_x64 - resource
win10 - submitted
14/10/2020, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Swift Copy.exe
- Size 490KB
- Sample201014-q2vpaeflke
- SHA256 8ce26cc2fb22fe3d89d7f4bd9ea925f0719ff9208b4e37b1f71b9d4e810bcc0c
- MD5 c7940438819a62c9dd82d206ca4db81f
- SHA1 86100dc4042fad3609e8eff175e1409f1b899eb2
- SHA512 5d5774311cb62deb5035204818d0c4559bfc76daa487d32f5846a2b42e3ccb3690608a37c44fdf3b33994d870433e7fac9ce88ed22fbad5667564df31a230369
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.purebodyrecovery.com/rhk/
Decoy
-
decodemethod.com
-
mamakeyfim.xyz
-
3smokers.com
-
rentaspendirect.com
-
projectstasksjobs.com
-
animedesignetees.com
-
ursthegardennurse.com
-
sunandmoonshirts.com
-
encuentros-es.com
-
nevadahomebirth.com
-
xoxoplants.com
-
tentenos.com
-
anhpham.net
-
beyondtourney.com
-
surfficient.com
-
wannahavedays.online
-
hmyhvgxax.icu
-
holisticskincarecompany.com
-
juggfuckers.com
-
ixgrmz.com
-
chant4yourlife.com
-
clgfzqgw.com
-
pandemiclearningpodsfairfax.com
-
pagmorlormun.com
-
m4ufred.com
-
xn--yaaou-zra.com
-
kai-tan.com
-
letstalkmamahk.com
-
nettbasertutdanning.com
-
phantheon.com
-
sweet-elite.com
-
eyepointph.com
-
hand-madebyrae.com
-
mexikanno.com
-
dunkerque-dentiste.com
-
novusingeniumgroup.com
-
fadin.xyz
-
azmro.com
-
vistaar.world
-
sobrietees.net
-
landschaftstechnik.com
-
roofingguidesite.com
-
betboo507.com
-
fromcelltosell.com
-
amianinfluencer.com
-
grayboxus.com
-
lamnhistudio.com
-
chyjzs.com
-
zhinengjiashiche.com
-
pchcmgrant.com
-
jnyijia.com
-
elementx.agency
-
izhangdong.com
-
topsit.website
-
travelswithsonny.com
-
traceqeisiholdings.com
-
audio-tron.com
-
moonstarinfinity.com
-
dream11exch9.com
-
pocketfieldtrip.com
-
mdsport-eg.com
-
southshoreagles.com
-
275353074.com
-
kgmba.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/192-6-0x000000000041EB10-mapping.dmp formbook behavioral2/memory/192-5-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2808-12-0x0000000000000000-mapping.dmp formbook - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2728 set thread context of 192 2728 Swift Copy.exe 73 PID 192 set thread context of 2968 192 Swift Copy.exe 56 PID 192 set thread context of 2968 192 Swift Copy.exe 56 PID 2808 set thread context of 2968 2808 systray.exe 56 - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2728 Swift Copy.exe 192 Swift Copy.exe 192 Swift Copy.exe 2728 Swift Copy.exe 192 Swift Copy.exe 192 Swift Copy.exe 192 Swift Copy.exe 192 Swift Copy.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe 2808 systray.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 192 Swift Copy.exe 192 Swift Copy.exe 192 Swift Copy.exe 192 Swift Copy.exe 2808 systray.exe 2808 systray.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2728 Swift Copy.exe Token: 33 2728 Swift Copy.exe Token: SeIncBasePriorityPrivilege 2728 Swift Copy.exe Token: SeDebugPrivilege 192 Swift Copy.exe Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeDebugPrivilege 2808 systray.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2728 wrote to memory of 192 2728 Swift Copy.exe 73 PID 2728 wrote to memory of 192 2728 Swift Copy.exe 73 PID 2728 wrote to memory of 192 2728 Swift Copy.exe 73 PID 2728 wrote to memory of 192 2728 Swift Copy.exe 73 PID 2728 wrote to memory of 192 2728 Swift Copy.exe 73 PID 2728 wrote to memory of 192 2728 Swift Copy.exe 73 PID 2728 wrote to memory of 2952 2728 Swift Copy.exe 74 PID 2728 wrote to memory of 2952 2728 Swift Copy.exe 74 PID 2728 wrote to memory of 2952 2728 Swift Copy.exe 74 PID 2728 wrote to memory of 1068 2728 Swift Copy.exe 76 PID 2728 wrote to memory of 1068 2728 Swift Copy.exe 76 PID 2728 wrote to memory of 1068 2728 Swift Copy.exe 76 PID 1068 wrote to memory of 1360 1068 cmd.exe 78 PID 1068 wrote to memory of 1360 1068 cmd.exe 78 PID 1068 wrote to memory of 1360 1068 cmd.exe 78 PID 2728 wrote to memory of 1512 2728 Swift Copy.exe 79 PID 2728 wrote to memory of 1512 2728 Swift Copy.exe 79 PID 2728 wrote to memory of 1512 2728 Swift Copy.exe 79 PID 192 wrote to memory of 2808 192 Swift Copy.exe 84 PID 192 wrote to memory of 2808 192 Swift Copy.exe 84 PID 192 wrote to memory of 2808 192 Swift Copy.exe 84 PID 2808 wrote to memory of 3392 2808 systray.exe 85 PID 2808 wrote to memory of 3392 2808 systray.exe 85 PID 2808 wrote to memory of 3392 2808 systray.exe 85
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:/Users/Admin/AppData/Local/Temp/Swift Copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"5⤵PID:3392
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Swift Copy.exe" "%temp%\FolderN\name.exe" /Y3⤵PID:2952
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f4⤵PID:1360
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier3⤵
- NTFS ADS
PID:1512
-
-