0974284b63c6c7d4fb340703dc1f43af8ab4f19d98cf4c34aa74e723991a8078

General

Target

SWIFT ADVICE-60000XXXX41.exe
Size

455KB
MD5

f4f45892718af0dd4ceb27dba0ae79d0
SHA1

f618394a3af17eb89ad889371d9a264bb4afd0bf
SHA256

0974284b63c6c7d4fb340703dc1f43af8ab4f19d98cf4c34aa74e723991a8078
SHA512

527daa4309f974e02c3c919a5b208c5144752b8007304472d3915d0ca4194d301c275f341364dc9c95e219b9589e40373c57f871c264ac912413477690b3f463

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1108-17-0x0000000010410000-0x00000000104D1000-memory.dmp	upx
behavioral1/memory/1352-19-0x0000000010410000-0x00000000104D1000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

Processes:

svchost.exeSWIFT ADVICE-60000XXXX41.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Tabs\cxe = "D1NbghnBXFa513VmmCDLzXla1GwLJ9C2RpbzOnFRYk8ED2/Vl+1P6UH2voCKX7vpqKXQPr8TU6OJ"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Tabs	SWIFT ADVICE-60000XXXX41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Tabs\cx = "D1NbghnBXFa513VmmCDLzXla1GwLJ9C2RpbzOnFRYk8ED2/Vl+1P6UH2voCKX7vpqKXQPr8TQKYQ"	SWIFT ADVICE-60000XXXX41.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Tabs	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Tabs\ovw = "D1NbghnBXFa513VmmCDLzXla1GwLJ9C2RpbzOnFRYk8ED2/Vl+1P6UH2voCKX7vpqKXQPr8TQKYQ"	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svchost.exe

pid process

1352 svchost.exe

pid	process
1352	svchost.exe

Suspicious use of WriteProcessMemory 131 IoCs

Processes:

SWIFT ADVICE-60000XXXX41.exeSWIFT ADVICE-60000XXXX41.exe

description	pid	process	target process
PID 1680 wrote to memory of 1108	1680	SWIFT ADVICE-60000XXXX41.exe	SWIFT ADVICE-60000XXXX41.exe
PID 1680 wrote to memory of 1108	1680	SWIFT ADVICE-60000XXXX41.exe	SWIFT ADVICE-60000XXXX41.exe
PID 1680 wrote to memory of 1108	1680	SWIFT ADVICE-60000XXXX41.exe	SWIFT ADVICE-60000XXXX41.exe
PID 1680 wrote to memory of 1108	1680	SWIFT ADVICE-60000XXXX41.exe	SWIFT ADVICE-60000XXXX41.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 1108 wrote to memory of 1352	1108	SWIFT ADVICE-60000XXXX41.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT ADVICE-60000XXXX41.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT ADVICE-60000XXXX41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\SWIFT ADVICE-60000XXXX41.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT ADVICE-60000XXXX41.exe" X6
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\mbbser.exe

MD5
f4f45892718af0dd4ceb27dba0ae79d0

SHA1
f618394a3af17eb89ad889371d9a264bb4afd0bf

SHA256
0974284b63c6c7d4fb340703dc1f43af8ab4f19d98cf4c34aa74e723991a8078

SHA512
527daa4309f974e02c3c919a5b208c5144752b8007304472d3915d0ca4194d301c275f341364dc9c95e219b9589e40373c57f871c264ac912413477690b3f463

Download Submit
memory/852-21-0x000007FEF81B0000-0x000007FEF842A000-memory.dmp

Filesize
2.5MB

Download
memory/1108-2-0x0000000000000000-mapping.dmp

Download
memory/1108-17-0x0000000010410000-0x00000000104D1000-memory.dmp

Filesize
772KB

Download
memory/1352-3-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1352-4-0x0000000000000000-mapping.dmp

Download
memory/1352-5-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1352-19-0x0000000010410000-0x00000000104D1000-memory.dmp

Filesize
772KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads