Analysis
- max time kernel
151s - max time network
154s - platform
windows10_x64 - resource
win10 - submitted
15/10/2020, 10:35
Static task
static1
Behavioral task
behavioral1
Sample
Mensaje SWIFT.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Mensaje SWIFT.exe
- Size 1.6MB
- Sample201015-pcqd8fexja
- SHA256 2f05200e09f38d2197fb48d265bcd4d050131f688ce51cf86478192df100d675
- MD5 e33828622c9d953e1e5ad7a3b16d2b77
- SHA1 c15e6c76cc4448a4f27ade1a70c4aaf2486503e6
- SHA512 903e518f4b481c13a10eef062a0499c72ff810dd1a3f0dad620cb5fa4b5b6cb244db999d09f7813e020b4fb24c54522f067903c60829d0f7f6c3a1c7a492d86f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.joomlas123.info/n7ak/
Decoy
-
audereventur.com
-
huro14.com
-
wwwjinsha155.com
-
antiquevendor.com
-
samuraisoulfood.net
-
traffic4updates.download
-
hypersarv.com
-
rapport-happy-wedding.com
-
rokutechnosupport.online
-
allworljob.com
-
hanaleedossmann.com
-
kauai-marathon.com
-
bepbosch.com
-
kangen-international.com
-
zoneshopemenowz.com
-
belviderewrestling.com
-
ipllink.com
-
sellingforcreators.com
-
wwwswty6655.com
-
qtumboa.com
-
bazarmoney.net
-
librosdecienciaficcion.com
-
shopmomsthebomb.com
-
vanjacob.com
-
tgyaa.com
-
theporncollective.net
-
hydrabadproperties.com
-
brindesecologicos.com
-
sayagayrimenkul.net
-
4btoken.com
-
shycedu.com
-
overall789.top
-
maison-pierre-bayle.com
-
elitemediamasters.com
-
sharmasfabrics.com
-
hoshamp.com
-
myultimateleadgenerator.com
-
office4u.info
-
thaimart1.com
-
ultimatewindowusa.com
-
twoblazesartworks.com
-
airteloffer.com
-
shoupaizhao.com
-
741dakotadr.info
-
books4arab.net
-
artedelcioccolato.biz
-
tjqcu.info
-
teccoop.net
-
maturebridesdressguide.com
-
excelcapfunding.com
-
bitcoinak.com
-
profileorderflow.com
-
unbelievabowboutique.com
-
midlandshomesolutionsltd.com
-
healthywithhook.com
-
stirlingpiper.com
-
manfast.online
-
arikorin.com
-
texastrustedinsurance.com
-
moodandmystery.com
-
yh77808.com
-
s-immotanger.com
-
runzexd.com
-
meteoannecy.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/364-10-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/364-11-0x000000000041E380-mapping.dmp formbook behavioral2/memory/1500-12-0x0000000000000000-mapping.dmp formbook - Executes dropped EXE 1 IoCs
pid Process 2076 Mensaje SWIFTmgr.exe -
resource yara_rule behavioral2/files/0x000100000001ad96-1.dat upx behavioral2/files/0x000100000001ad96-2.dat upx - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeBCHost.url Mensaje SWIFT.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HBFTQ = "C:\\Program Files (x86)\\Ycbc\\ztdlfpx8gdmlefix.exe" mstsc.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3588 set thread context of 364 3588 Mensaje SWIFT.exe 76 PID 364 set thread context of 2988 364 Mensaje SWIFT.exe 56 PID 1500 set thread context of 2988 1500 mstsc.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ycbc\ztdlfpx8gdmlefix.exe mstsc.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3272 2076 WerFault.exe 72 -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe - Suspicious behavior: EnumeratesProcesses 70 IoCs
pid Process 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 3272 WerFault.exe 364 Mensaje SWIFT.exe 364 Mensaje SWIFT.exe 364 Mensaje SWIFT.exe 364 Mensaje SWIFT.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3588 Mensaje SWIFT.exe 364 Mensaje SWIFT.exe 364 Mensaje SWIFT.exe 364 Mensaje SWIFT.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe 1500 mstsc.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 3272 WerFault.exe Token: SeBackupPrivilege 3272 WerFault.exe Token: SeDebugPrivilege 3272 WerFault.exe Token: SeDebugPrivilege 364 Mensaje SWIFT.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeDebugPrivilege 1500 mstsc.exe Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE Token: SeShutdownPrivilege 2988 Explorer.EXE Token: SeCreatePagefilePrivilege 2988 Explorer.EXE - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3588 Mensaje SWIFT.exe 3588 Mensaje SWIFT.exe 3588 Mensaje SWIFT.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3588 Mensaje SWIFT.exe 3588 Mensaje SWIFT.exe 3588 Mensaje SWIFT.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3588 wrote to memory of 2076 3588 Mensaje SWIFT.exe 72 PID 3588 wrote to memory of 2076 3588 Mensaje SWIFT.exe 72 PID 3588 wrote to memory of 2076 3588 Mensaje SWIFT.exe 72 PID 3588 wrote to memory of 364 3588 Mensaje SWIFT.exe 76 PID 3588 wrote to memory of 364 3588 Mensaje SWIFT.exe 76 PID 3588 wrote to memory of 364 3588 Mensaje SWIFT.exe 76 PID 3588 wrote to memory of 364 3588 Mensaje SWIFT.exe 76 PID 2988 wrote to memory of 1500 2988 Explorer.EXE 77 PID 2988 wrote to memory of 1500 2988 Explorer.EXE 77 PID 2988 wrote to memory of 1500 2988 Explorer.EXE 77 PID 1500 wrote to memory of 2644 1500 mstsc.exe 82 PID 1500 wrote to memory of 2644 1500 mstsc.exe 82 PID 1500 wrote to memory of 2644 1500 mstsc.exe 82 PID 1500 wrote to memory of 1172 1500 mstsc.exe 84 PID 1500 wrote to memory of 1172 1500 mstsc.exe 84 PID 1500 wrote to memory of 1172 1500 mstsc.exe 84 PID 1500 wrote to memory of 2416 1500 mstsc.exe 86 PID 1500 wrote to memory of 2416 1500 mstsc.exe 86 PID 1500 wrote to memory of 2416 1500 mstsc.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFTmgr.exe"C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFTmgr.exe"3⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 2764⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:364
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Mensaje SWIFT.exe"3⤵PID:2644
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1172
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2416
-
-