Swift Copy.zip

General
Target

Swift copy .xls.exe

Filesize

360KB

Completed

23-02-2021 11:36

Score
10 /10
MD5

21f7a17e1a7bf3ea8e5b77beec1dd94f

SHA1

d6d0529b2bc4b8ed2c10d4c0e0730cd90421a744

SHA256

f1a7b6a46915fa2b34597413808c3f79379961e645ec613ec09dd0cd0a8722f0

Malware Config

Extracted

Family warzonerat
C2

194.5.97.116:1360

Signatures 15

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • WarzoneRat, AveMaria

    Description

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1564-10-0x0000000000400000-0x0000000000554000-memory.dmpwarzonerat
    behavioral1/memory/1564-11-0x0000000000405CE2-mapping.dmpwarzonerat
    behavioral1/memory/1564-13-0x0000000000400000-0x0000000000554000-memory.dmpwarzonerat
  • Sets DLL path for service in the registry

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Loads dropped DLL
    Swift copy .xls.exe

    Reported IOCs

    pidprocess
    1004
    1564Swift copy .xls.exe
    1564Swift copy .xls.exe
    1564Swift copy .xls.exe
    1564Swift copy .xls.exe
    1564Swift copy .xls.exe
    1564Swift copy .xls.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Modifies WinLogon
    Swift copy .xls.exe

    TTPs

    Winlogon Helper DLLModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSwift copy .xls.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccountsSwift copy .xls.exe
    Set value (int)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\HFttfjt = "0"Swift copy .xls.exe
    Set value (int)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"Swift copy .xls.exe
  • Drops file in System32 directory
    Swift copy .xls.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\System32\rfxvmt.dllSwift copy .xls.exe
  • Suspicious use of SetThreadContext
    Swift copy .xls.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1064 set thread context of 15641064Swift copy .xls.exeSwift copy .xls.exe
  • Drops file in Program Files directory
    Swift copy .xls.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Program Files\Microsoft DN1\sqlmap.dllSwift copy .xls.exe
    File createdC:\Program Files\Microsoft DN1\rdpwrap.iniSwift copy .xls.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1508schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    Swift copy .xls.exe

    Reported IOCs

    pidprocess
    1064Swift copy .xls.exe
  • Suspicious behavior: LoadsDriver

    Reported IOCs

    pidprocess
    1004
    1004
    1004
  • Suspicious use of AdjustPrivilegeToken
    Swift copy .xls.exeSwift copy .xls.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1064Swift copy .xls.exe
    Token: SeDebugPrivilege1564Swift copy .xls.exe
  • Suspicious use of WriteProcessMemory
    Swift copy .xls.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1064 wrote to memory of 15081064Swift copy .xls.exeschtasks.exe
    PID 1064 wrote to memory of 15081064Swift copy .xls.exeschtasks.exe
    PID 1064 wrote to memory of 15081064Swift copy .xls.exeschtasks.exe
    PID 1064 wrote to memory of 15081064Swift copy .xls.exeschtasks.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
    PID 1064 wrote to memory of 15641064Swift copy .xls.exeSwift copy .xls.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\Swift copy .xls.exe
    "C:\Users\Admin\AppData\Local\Temp\Swift copy .xls.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AsLvNjC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD92F.tmp"
      Creates scheduled task(s)
      PID:1508
    • C:\Users\Admin\AppData\Local\Temp\Swift copy .xls.exe
      "{path}"
      Loads dropped DLL
      Modifies WinLogon
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:1564
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\AppData\Local\Temp\tmpD92F.tmp

                  MD5

                  4bd744f297162b8b562a4952abb92105

                  SHA1

                  840481880734410f1c1d65207f7ffdcd6b076b3e

                  SHA256

                  7a57054734bce7716aa425874bb1a13ef39028479023bb7bcf68a828a7385dce

                  SHA512

                  5c94b3f8a7e98a761981d6f6b8d827753af496ccb09d0e6e283ac2c5efe315fe30807e7b6e6392ac65db41b71dca33beb9b45a6f5e3b5636093c78659831400a

                • \Program Files\Microsoft DN1\sqlmap.dll

                  MD5

                  461ade40b800ae80a40985594e1ac236

                  SHA1

                  b3892eef846c044a2b0785d54a432b3e93a968c8

                  SHA256

                  798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                  SHA512

                  421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                • \Users\Admin\AppData\Local\Temp\freebl3.dll

                  MD5

                  ef12ab9d0b231b8f898067b2114b1bc0

                  SHA1

                  6d90f27b2105945f9bb77039e8b892070a5f9442

                  SHA256

                  2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7

                  SHA512

                  2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193

                • \Users\Admin\AppData\Local\Temp\mozglue.dll

                  MD5

                  75f8cc548cabf0cc800c25047e4d3124

                  SHA1

                  602676768f9faecd35b48c38a0632781dfbde10c

                  SHA256

                  fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0

                  SHA512

                  ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f

                • \Users\Admin\AppData\Local\Temp\msvcp140.dll

                  MD5

                  109f0f02fd37c84bfc7508d4227d7ed5

                  SHA1

                  ef7420141bb15ac334d3964082361a460bfdb975

                  SHA256

                  334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                  SHA512

                  46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                • \Users\Admin\AppData\Local\Temp\nss3.dll

                  MD5

                  d7858e8449004e21b01d468e9fd04b82

                  SHA1

                  9524352071ede21c167e7e4f106e9526dc23ef4e

                  SHA256

                  78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db

                  SHA512

                  1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440

                • \Users\Admin\AppData\Local\Temp\softokn3.dll

                  MD5

                  471c983513694ac3002590345f2be0da

                  SHA1

                  6612b9af4ff6830fa9b7d4193078434ef72f775b

                  SHA256

                  bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f

                  SHA512

                  a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410

                • \Users\Admin\AppData\Local\Temp\vcruntime140.dll

                  MD5

                  7587bf9cb4147022cd5681b015183046

                  SHA1

                  f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                  SHA256

                  c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                  SHA512

                  0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                • memory/1004-14-0x000007FEF56D0000-0x000007FEF594A000-memory.dmp

                • memory/1064-5-0x0000000004F00000-0x0000000004F01000-memory.dmp

                • memory/1064-6-0x00000000003F0000-0x00000000003FB000-memory.dmp

                • memory/1064-7-0x0000000004420000-0x0000000004468000-memory.dmp

                • memory/1064-3-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

                • memory/1064-2-0x00000000740B0000-0x000000007479E000-memory.dmp

                • memory/1508-8-0x0000000000000000-mapping.dmp

                • memory/1564-16-0x0000000003060000-0x00000000030E4000-memory.dmp

                • memory/1564-12-0x0000000076101000-0x0000000076103000-memory.dmp

                • memory/1564-11-0x0000000000405CE2-mapping.dmp

                • memory/1564-10-0x0000000000400000-0x0000000000554000-memory.dmp

                • memory/1564-13-0x0000000000400000-0x0000000000554000-memory.dmp