0974284b63c6c7d4fb340703dc1f43af8ab4f19d98cf4c34aa74e723991a8078

General

Target

SWIFT ADVICE-60000XXXX41.exe
Size

455KB
MD5

f4f45892718af0dd4ceb27dba0ae79d0
SHA1

f618394a3af17eb89ad889371d9a264bb4afd0bf
SHA256

0974284b63c6c7d4fb340703dc1f43af8ab4f19d98cf4c34aa74e723991a8078
SHA512

527daa4309f974e02c3c919a5b208c5144752b8007304472d3915d0ca4194d301c275f341364dc9c95e219b9589e40373c57f871c264ac912413477690b3f463

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2712-15-0x0000000010410000-0x00000000104D1000-memory.dmp	upx
behavioral2/memory/3556-17-0x0000000010410000-0x00000000104D1000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

Processes:

svchost.exeSWIFT ADVICE-60000XXXX41.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Tabs	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Tabs\ovw = "D1NbghnBXFa513VmmCDLzXla1GwLJ9C2RpbzOnFRYk8ED2/Vl+1P6UH2voCKX7vpqKXQPr8TQKYQ"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Tabs\cxe = "D1NbghnBXFa513VmmCDLzXla1GwLJ9C2RpbzOnFRYk8ED2/Vl+1P6UH2voCKX7vpqKXQPr8TU6OJ"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Tabs	SWIFT ADVICE-60000XXXX41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Tabs\cx = "D1NbghnBXFa513VmmCDLzXla1GwLJ9C2RpbzOnFRYk8ED2/Vl+1P6UH2voCKX7vpqKXQPr8TQKYQ"	SWIFT ADVICE-60000XXXX41.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svchost.exe

pid process

3556 svchost.exe

pid	process
3556	svchost.exe

Suspicious use of WriteProcessMemory 129 IoCs

Processes:

SWIFT ADVICE-60000XXXX41.exeSWIFT ADVICE-60000XXXX41.exe

description	pid	process	target process
PID 988 wrote to memory of 2712	988	SWIFT ADVICE-60000XXXX41.exe	SWIFT ADVICE-60000XXXX41.exe
PID 988 wrote to memory of 2712	988	SWIFT ADVICE-60000XXXX41.exe	SWIFT ADVICE-60000XXXX41.exe
PID 988 wrote to memory of 2712	988	SWIFT ADVICE-60000XXXX41.exe	SWIFT ADVICE-60000XXXX41.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe
PID 2712 wrote to memory of 3556	2712	SWIFT ADVICE-60000XXXX41.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT ADVICE-60000XXXX41.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT ADVICE-60000XXXX41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Local\Temp\SWIFT ADVICE-60000XXXX41.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT ADVICE-60000XXXX41.exe" X6
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\mbbser.exe

MD5
f4f45892718af0dd4ceb27dba0ae79d0

SHA1
f618394a3af17eb89ad889371d9a264bb4afd0bf

SHA256
0974284b63c6c7d4fb340703dc1f43af8ab4f19d98cf4c34aa74e723991a8078

SHA512
527daa4309f974e02c3c919a5b208c5144752b8007304472d3915d0ca4194d301c275f341364dc9c95e219b9589e40373c57f871c264ac912413477690b3f463

Download Submit
memory/2712-2-0x0000000000000000-mapping.dmp

Download
memory/2712-15-0x0000000010410000-0x00000000104D1000-memory.dmp

Filesize
772KB

Download
memory/3556-4-0x0000000000000000-mapping.dmp

Download
memory/3556-3-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/3556-5-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/3556-17-0x0000000010410000-0x00000000104D1000-memory.dmp

Filesize
772KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads