Analysis
-
max time kernel
152s -
max time network
177s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-09-2021 19:17
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7v20210408
General
-
Target
Swift Copy.exe
-
Size
696KB
-
MD5
c3ad076b201b02706effd72bbdfe71c4
-
SHA1
05a3a508addfd530113fb6f78122164476d3f651
-
SHA256
61de0ac2005f1345bfb72a35e04d02e41d981e6ffa23944d3b1cae93be22856b
-
SHA512
fe0441c5043fbc6620ad6c37a926df966ecb0a3797402a79ba0cd6e44743419b418d18890ab36dae09c27deefda74992845ebacb09c7d2cd15af3fd4dc659d1b
Malware Config
Extracted
xloader
2.3
n58i
http://www.biosonicmicrocurrent.com/n58i/
electrifyz.com
silkpetalz.net
cognitivenavigation.com
poophaikus.com
orchidiris.com
arteregalos.com
dailybookmarks.info
gogoanume.pro
hushmailgmx.com
trjisa.com
notontrend.com
2020polltax.com
orderhappy.club
panggabean.net
govsathi.com
hrsbxg.com
xvideotokyo.online
lotteplaze.com
lovecleanliveclean.com
swaphomeloans.net
arcadems.info
creatingstrongerathletes.com
follaproperties.com
i-postgram.com
bootybella.fitness
avtofan.net
bimbavbi.com
yourtravelsbuddy.com
laiofit.com
ofnick.com
2g6gc6zma9g.net
phamthanhdam.com
shopteve.com
add-fast.com
studioloungemke.com
maxtoutfitness.com
mapleway.systems
login-settings.com
affoshop.com
hupubets.com
3energyservices.com
ccmfonline.com
keyhousebuyers.com
curvecue.com
developerdevelopment.com
jamesdunnandsons.com
devyassine.com
dongyilove.com
alienpuran.com
tuolp.com
bidprosper.com
feerd.com
acmeproxy.com
thechoicemediagroup.com
inspirespeep.com
leesangsoon.com
highheatcards.com
xn--yk3b99erra.com
rawfasteners.com
alfaniyaa.com
bellesaesthetics.com
ccequityholdings.com
carrolpuppies.com
huttibazar.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1208-66-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1208-67-0x000000000041D040-mapping.dmp xloader behavioral1/memory/316-75-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Swift Copy.exeRegSvcs.exemstsc.exedescription pid process target process PID 1832 set thread context of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1208 set thread context of 1212 1208 RegSvcs.exe Explorer.EXE PID 316 set thread context of 1212 316 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Swift Copy.exeRegSvcs.exemstsc.exepid process 1832 Swift Copy.exe 1832 Swift Copy.exe 1208 RegSvcs.exe 1208 RegSvcs.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe 316 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exemstsc.exepid process 1208 RegSvcs.exe 1208 RegSvcs.exe 1208 RegSvcs.exe 316 mstsc.exe 316 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Swift Copy.exeRegSvcs.exemstsc.exedescription pid process Token: SeDebugPrivilege 1832 Swift Copy.exe Token: SeDebugPrivilege 1208 RegSvcs.exe Token: SeDebugPrivilege 316 mstsc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Swift Copy.exeExplorer.EXEmstsc.exedescription pid process target process PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1832 wrote to memory of 1208 1832 Swift Copy.exe RegSvcs.exe PID 1212 wrote to memory of 316 1212 Explorer.EXE mstsc.exe PID 1212 wrote to memory of 316 1212 Explorer.EXE mstsc.exe PID 1212 wrote to memory of 316 1212 Explorer.EXE mstsc.exe PID 1212 wrote to memory of 316 1212 Explorer.EXE mstsc.exe PID 316 wrote to memory of 1740 316 mstsc.exe cmd.exe PID 316 wrote to memory of 1740 316 mstsc.exe cmd.exe PID 316 wrote to memory of 1740 316 mstsc.exe cmd.exe PID 316 wrote to memory of 1740 316 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-74-0x0000000000D90000-0x0000000000E94000-memory.dmpFilesize
1.0MB
-
memory/316-77-0x0000000000790000-0x000000000081F000-memory.dmpFilesize
572KB
-
memory/316-76-0x00000000022A0000-0x00000000025A3000-memory.dmpFilesize
3.0MB
-
memory/316-75-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/316-71-0x0000000000000000-mapping.dmp
-
memory/316-72-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1208-66-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1208-67-0x000000000041D040-mapping.dmp
-
memory/1208-68-0x0000000000BC0000-0x0000000000EC3000-memory.dmpFilesize
3.0MB
-
memory/1208-69-0x00000000000D0000-0x00000000000E0000-memory.dmpFilesize
64KB
-
memory/1212-78-0x00000000071E0000-0x00000000072DF000-memory.dmpFilesize
1020KB
-
memory/1212-70-0x0000000006720000-0x00000000068C7000-memory.dmpFilesize
1.7MB
-
memory/1740-73-0x0000000000000000-mapping.dmp
-
memory/1832-60-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/1832-65-0x0000000000BA0000-0x0000000000BCA000-memory.dmpFilesize
168KB
-
memory/1832-64-0x0000000005060000-0x00000000050BF000-memory.dmpFilesize
380KB
-
memory/1832-63-0x0000000000460000-0x0000000000476000-memory.dmpFilesize
88KB
-
memory/1832-62-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB