Overview

overview

10

Static

static

Mensaje SWIFT.exe

windows7_x64

10

Mensaje SWIFT.exe

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    15/10/2020, 10:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Mensaje SWIFT.exe
  • Size 1.6MB
  • Sample201015-pcqd8fexja
  • SHA256 2f05200e09f38d2197fb48d265bcd4d050131f688ce51cf86478192df100d675
  • MD5 SHA1 SHA512
Score
10/10
upxratpersistencespywaretrojanstealerformbook

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.joomlas123.info/n7ak/

Decoy

  • audereventur.com

  • huro14.com

  • wwwjinsha155.com

  • antiquevendor.com

  • samuraisoulfood.net

  • traffic4updates.download

  • hypersarv.com

  • rapport-happy-wedding.com

  • rokutechnosupport.online

  • allworljob.com

  • hanaleedossmann.com

  • kauai-marathon.com

  • bepbosch.com

  • kangen-international.com

  • zoneshopemenowz.com

  • belviderewrestling.com

  • ipllink.com

  • sellingforcreators.com

  • wwwswty6655.com

  • qtumboa.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook Payload 6 IoCs
    rat
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 54 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: MapViewOfSection 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 157 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
      "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFTmgr.exe
        "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFTmgr.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:1812
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1236
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:1824
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1344
      • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
        "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
        3⤵
          PID:1784
        • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
          "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
          3⤵
            PID:516
          • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
            "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
            3⤵
              PID:460
            • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
              "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
              3⤵
                PID:832
              • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                3⤵
                  PID:1324
                • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                  "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                  3⤵
                    PID:612
                  • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                    "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                    3⤵
                      PID:1140
                    • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                      "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                      3⤵
                        PID:892
                      • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                        "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                        3⤵
                          PID:292
                        • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                          "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                          3⤵
                            PID:1636
                          • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                            "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                            3⤵
                              PID:1584
                            • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                              "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                              3⤵
                                PID:1640
                              • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                3⤵
                                  PID:1548
                                • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                  3⤵
                                    PID:1964
                                  • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                    3⤵
                                      PID:1940
                                    • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                      3⤵
                                        PID:1920
                                      • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                        3⤵
                                          PID:1924
                                        • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                          3⤵
                                            PID:2024
                                          • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                            3⤵
                                              PID:2004
                                            • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                              3⤵
                                                PID:2012
                                              • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                3⤵
                                                  PID:1984
                                                • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                  3⤵
                                                    PID:1232
                                                  • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                    3⤵
                                                      PID:1336
                                                    • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                      3⤵
                                                        PID:1412
                                                      • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                        3⤵
                                                          PID:1012
                                                        • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                          3⤵
                                                            PID:1044
                                                          • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                            3⤵
                                                              PID:300
                                                            • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                              3⤵
                                                                PID:2028
                                                              • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                                3⤵
                                                                  PID:1896
                                                                • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                                  3⤵
                                                                    PID:476
                                                                  • C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                                    3⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1128
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  "C:\Windows\SysWOW64\cscript.exe"
                                                                  2⤵
                                                                  • Adds policy Run key to start application
                                                                  • Suspicious use of SetThreadContext
                                                                  • Drops file in Program Files directory
                                                                  • Modifies Internet Explorer settings
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • System policy modification
                                                                  PID:1072
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    /c del "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"
                                                                    3⤵
                                                                    • Deletes itself
                                                                    PID:1800
                                                                  • C:\Program Files\Mozilla Firefox\Firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                    3⤵
                                                                      PID:1688

                                                                Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      memory/1072-51-0x0000000001EC0000-0x0000000001F76000-memory.dmp
                                                                      Download

                                                                      memory/1072-54-0x0000000003380000-0x0000000003475000-memory.dmp
                                                                      Download

                                                                      memory/1072-56-0x0000000003380000-0x0000000003475000-memory.dmp
                                                                      Download

                                                                      memory/1072-44-0x00000000009F0000-0x0000000000A12000-memory.dmp
                                                                      Download

                                                                      memory/1072-47-0x0000000001EC0000-0x0000000001F76000-memory.dmp
                                                                      Download

                                                                      memory/1072-48-0x0000000003380000-0x0000000003475000-memory.dmp
                                                                      Download

                                                                      memory/1128-37-0x0000000000400000-0x000000000042D000-memory.dmp
                                                                      Download

                                                                      memory/1504-6-0x00000000005A0000-0x00000000005CD000-memory.dmp
                                                                      Download

                                                                      memory/1672-23-0x000007FEF6C50000-0x000007FEF6ECA000-memory.dmp
                                                                      Download

                                                                      memory/1812-49-0x0000000000472000-0x0000000000474000-memory.dmp
                                                                      Download

                                                                      memory/1824-52-0x00000000003FB000-0x00000000003FC000-memory.dmp
                                                                      Download