Analysis
-
max time kernel
73s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 06:28
Static task
static1
Behavioral task
behavioral1
Sample
swift.05fd90a7-b0d0-49e8-9d15.exe
Resource
win7v20201028
General
-
Target
swift.05fd90a7-b0d0-49e8-9d15.exe
-
Size
1.1MB
-
MD5
b8d1d81917069e3cdf34088836efe9c0
-
SHA1
b7161586fa8437a6bdf0d3a15c831d35b0f0e262
-
SHA256
e79083b58aae06c0413f65d3979fcad177112e4f49ef3568d0b52392b07ff720
-
SHA512
e116f728f36e09cd325a8617668d434db555cffa4282dba96591afa974f4c79bb0385922677eb67945c98b3508648397b1af16041388c7224cb1ebbf9a7f5e72
Malware Config
Extracted
formbook
http://www.wekrazy.com/ianv/
toysclass.com
baohiemthuduc.com
dronesracers.com
wallis-platform.com
waltermorgan.fitness
vsn-designs.com
cengjing.life
trackcatologueorders.com
newworkpay.com
brainywoodindia.com
myrtlebeachstripperstoyou.com
saori.cloud
10fastvpn.com
freemindsweden.com
phatsquares.com
pandemia.tienda
7560eads6.com
sabjidada.com
zhyingj.group
nailmanicurest.com
makkoho.net
biaobazhongxin.com
wwwyourcardoctor.com
careless-customers2.com
greghickmanrealestate.com
testdomain0606.site
cantstealmyvote.com
binismailhealthcare.com
impact-holdingsgroup.com
plastic-girl.com
itcomputershn.com
racevx.xyz
jiangsuruiyou.com
tuding1688.com
kimloaig7.net
kannanconsulting.com
reconnecttogod.com
solverstv.com
therecover.computer
iamalittlesomething.com
rottendemocrats.com
triplayover.com
classonlinepy.com
magapatriotsdeals.com
casafacilpe.com
umasolarsupply.com
getinfloww.com
thecleanlifellc.com
knownyork.com
practicewithpersia.com
hervirtuouslife.com
goldjewelrybuyersplano.com
belleharlo.com
bundatrima.online
localvahomes.com
petreltradingchambers.com
jueligh.com
awadata.com
craftedcompulsion.com
dresiara.com
natsu-blog.net
nonbartv.com
greezymobbent.com
opelakcesoria.online
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1004-4-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1004-5-0x000000000041D040-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
swift.05fd90a7-b0d0-49e8-9d15.exedescription pid process target process PID 3976 set thread context of 1004 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
swift.05fd90a7-b0d0-49e8-9d15.exeswift.05fd90a7-b0d0-49e8-9d15.exepid process 3976 swift.05fd90a7-b0d0-49e8-9d15.exe 3976 swift.05fd90a7-b0d0-49e8-9d15.exe 1004 swift.05fd90a7-b0d0-49e8-9d15.exe 1004 swift.05fd90a7-b0d0-49e8-9d15.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
swift.05fd90a7-b0d0-49e8-9d15.exedescription pid process Token: SeDebugPrivilege 3976 swift.05fd90a7-b0d0-49e8-9d15.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
swift.05fd90a7-b0d0-49e8-9d15.exedescription pid process target process PID 3976 wrote to memory of 3188 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe PID 3976 wrote to memory of 3188 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe PID 3976 wrote to memory of 3188 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe PID 3976 wrote to memory of 1004 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe PID 3976 wrote to memory of 1004 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe PID 3976 wrote to memory of 1004 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe PID 3976 wrote to memory of 1004 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe PID 3976 wrote to memory of 1004 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe PID 3976 wrote to memory of 1004 3976 swift.05fd90a7-b0d0-49e8-9d15.exe swift.05fd90a7-b0d0-49e8-9d15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"C:\Users\Admin\AppData\Local\Temp\swift.05fd90a7-b0d0-49e8-9d15.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1004-4-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1004-5-0x000000000041D040-mapping.dmp
-
memory/1004-7-0x0000000001620000-0x0000000001940000-memory.dmpFilesize
3.1MB
-
memory/3976-2-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/3976-3-0x00000000024A1000-0x00000000024A2000-memory.dmpFilesize
4KB