Analysis
-
max time kernel
150s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
27-02-2021 16:22
Static task
static1
Behavioral task
behavioral1
Sample
swiftcopy.exe
Resource
win7v20201028
General
-
Target
swiftcopy.exe
-
Size
659KB
-
MD5
58a31f7df6c75f13a2dfcbb4b75cdf5a
-
SHA1
5ea239556ec4d627ae9aa0d89eb2bb5a6d43fcb0
-
SHA256
6c8141b5a0c080453e977556384f927bc36d7bbab64f98c854a5cf2b6f085106
-
SHA512
99c23b6f9fa5d20d9d5a28a353056fb71d6cbfcef54d5243ba9c31bc6e4d02099b5d14538d8202da3ef9a5884f95cc615cdd20a6a3260bbf09a4d166e1f0f3bf
Malware Config
Extracted
formbook
http://www.haxors-list.com/wo72/
spiritualclothings.com
casalesandleasing.com
ys6-best.com
kaurmortgages.com
ktop10.com
designsbydevan.com
modelsch.com
airh20.com
meganepa-man.com
ellysprimerib.com
teapod.club
travelsjob.com
thefundraisingguru.com
crutoshare.com
royaltxsklusvboutique.com
wberr.net
neilwilloughby.com
meaninginmedia.com
specialtogo.com
ofyoursproducts.com
928uk.com
xgqrugby.info
idoctorphil.com
verifybadgenext.com
bigpapapbbq.com
ashleybarlowco.com
piensosarcadia.com
luxymodern.com
thebestcbdgummiesusa.com
susiebshares.net
mymumbailive.com
izmirledtvservisi.com
traduccionesok.xyz
peakperformllc.com
grannishairy.com
normafrahncoaching.com
tr3sm.com
nganinhthumieng.com
medpharm-llc.com
viziosrolls.com
sustainable.coach
skylerwira.net
podprzykrywka.com
prodemad.com
bhavnainvestments.com
zoeyspencer.com
alanscohn.com
createawealthy.life
notemanches.com
justbrandish.com
shubhangel.com
one.limo
newzhuoxin.com
dijanetic.com
ecogiftwrapper.com
nnsxykj.com
barahonaapartments.com
nudist101.com
lushpopsicles.com
stroudnotary.com
kamalamvp.com
slipnlaw.com
antey-tm.com
sparkupfantasy.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/756-9-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/756-10-0x000000000041ED20-mapping.dmp formbook behavioral1/memory/1900-19-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
swiftcopy.exeRegSvcs.exemsiexec.exedescription pid process target process PID 2008 set thread context of 756 2008 swiftcopy.exe RegSvcs.exe PID 756 set thread context of 1248 756 RegSvcs.exe Explorer.EXE PID 1900 set thread context of 1248 1900 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 756 RegSvcs.exe 756 RegSvcs.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe 1900 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 756 RegSvcs.exe 756 RegSvcs.exe 756 RegSvcs.exe 1900 msiexec.exe 1900 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exemsiexec.exedescription pid process Token: SeDebugPrivilege 756 RegSvcs.exe Token: SeDebugPrivilege 1900 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
swiftcopy.exeExplorer.EXEmsiexec.exedescription pid process target process PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 2008 wrote to memory of 756 2008 swiftcopy.exe RegSvcs.exe PID 1248 wrote to memory of 1900 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1900 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1900 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1900 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1900 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1900 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1900 1248 Explorer.EXE msiexec.exe PID 1900 wrote to memory of 704 1900 msiexec.exe cmd.exe PID 1900 wrote to memory of 704 1900 msiexec.exe cmd.exe PID 1900 wrote to memory of 704 1900 msiexec.exe cmd.exe PID 1900 wrote to memory of 704 1900 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swiftcopy.exe"C:\Users\Admin\AppData\Local\Temp\swiftcopy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/704-17-0x0000000000000000-mapping.dmp
-
memory/756-9-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/756-13-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/756-12-0x0000000000AB0000-0x0000000000DB3000-memory.dmpFilesize
3.0MB
-
memory/756-10-0x000000000041ED20-mapping.dmp
-
memory/1248-14-0x0000000004F30000-0x000000000503F000-memory.dmpFilesize
1.1MB
-
memory/1900-16-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1900-15-0x0000000000000000-mapping.dmp
-
memory/1900-18-0x0000000000ED0000-0x0000000000EE4000-memory.dmpFilesize
80KB
-
memory/1900-19-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1900-20-0x00000000022F0000-0x00000000025F3000-memory.dmpFilesize
3.0MB
-
memory/1900-21-0x0000000000B20000-0x0000000000BB3000-memory.dmpFilesize
588KB
-
memory/2008-8-0x0000000000790000-0x00000000007CF000-memory.dmpFilesize
252KB
-
memory/2008-7-0x0000000005080000-0x00000000050E9000-memory.dmpFilesize
420KB
-
memory/2008-6-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/2008-5-0x0000000000530000-0x000000000053B000-memory.dmpFilesize
44KB
-
memory/2008-2-0x0000000074BA0000-0x000000007528E000-memory.dmpFilesize
6.9MB
-
memory/2008-3-0x0000000001170000-0x0000000001171000-memory.dmpFilesize
4KB