Analysis
-
max time kernel
151s -
max time network
163s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
10-09-2021 05:25
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-en
General
-
Target
Swift Copy.exe
-
Size
459KB
-
MD5
3b2a3fb863cf4f30e508e7be83d5adc7
-
SHA1
b81ab8811217e31a7ff73e6defd0c51b0ceba101
-
SHA256
acf3df7da4bdf99226ab8574e15d1145e46e28605afdf660f1fb19b1d061c386
-
SHA512
c24ad26caea342de74148c29f45a1891d19989f8af63ba51da2877ad7bcf65a2f4449f1b8f638d38efd5ce44e14b8dc58930fcb9fe53563eac26ce64f211214d
Malware Config
Extracted
xloader
2.3
n58i
http://www.biosonicmicrocurrent.com/n58i/
electrifyz.com
silkpetalz.net
cognitivenavigation.com
poophaikus.com
orchidiris.com
arteregalos.com
dailybookmarks.info
gogoanume.pro
hushmailgmx.com
trjisa.com
notontrend.com
2020polltax.com
orderhappy.club
panggabean.net
govsathi.com
hrsbxg.com
xvideotokyo.online
lotteplaze.com
lovecleanliveclean.com
swaphomeloans.net
arcadems.info
creatingstrongerathletes.com
follaproperties.com
i-postgram.com
bootybella.fitness
avtofan.net
bimbavbi.com
yourtravelsbuddy.com
laiofit.com
ofnick.com
2g6gc6zma9g.net
phamthanhdam.com
shopteve.com
add-fast.com
studioloungemke.com
maxtoutfitness.com
mapleway.systems
login-settings.com
affoshop.com
hupubets.com
3energyservices.com
ccmfonline.com
keyhousebuyers.com
curvecue.com
developerdevelopment.com
jamesdunnandsons.com
devyassine.com
dongyilove.com
alienpuran.com
tuolp.com
bidprosper.com
feerd.com
acmeproxy.com
thechoicemediagroup.com
inspirespeep.com
leesangsoon.com
highheatcards.com
xn--yk3b99erra.com
rawfasteners.com
alfaniyaa.com
bellesaesthetics.com
ccequityholdings.com
carrolpuppies.com
huttibazar.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3476-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3476-125-0x000000000041D040-mapping.dmp xloader behavioral2/memory/3640-132-0x0000000002DB0000-0x0000000002DD8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Swift Copy.exeRegSvcs.execmstp.exedescription pid process target process PID 3260 set thread context of 3476 3260 Swift Copy.exe RegSvcs.exe PID 3476 set thread context of 3016 3476 RegSvcs.exe Explorer.EXE PID 3640 set thread context of 3016 3640 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Swift Copy.exeRegSvcs.execmstp.exepid process 3260 Swift Copy.exe 3260 Swift Copy.exe 3476 RegSvcs.exe 3476 RegSvcs.exe 3476 RegSvcs.exe 3476 RegSvcs.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe 3640 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmstp.exepid process 3476 RegSvcs.exe 3476 RegSvcs.exe 3476 RegSvcs.exe 3640 cmstp.exe 3640 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Swift Copy.exeRegSvcs.execmstp.exedescription pid process Token: SeDebugPrivilege 3260 Swift Copy.exe Token: SeDebugPrivilege 3476 RegSvcs.exe Token: SeDebugPrivilege 3640 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Swift Copy.exeExplorer.EXEcmstp.exedescription pid process target process PID 3260 wrote to memory of 3476 3260 Swift Copy.exe RegSvcs.exe PID 3260 wrote to memory of 3476 3260 Swift Copy.exe RegSvcs.exe PID 3260 wrote to memory of 3476 3260 Swift Copy.exe RegSvcs.exe PID 3260 wrote to memory of 3476 3260 Swift Copy.exe RegSvcs.exe PID 3260 wrote to memory of 3476 3260 Swift Copy.exe RegSvcs.exe PID 3260 wrote to memory of 3476 3260 Swift Copy.exe RegSvcs.exe PID 3016 wrote to memory of 3640 3016 Explorer.EXE cmstp.exe PID 3016 wrote to memory of 3640 3016 Explorer.EXE cmstp.exe PID 3016 wrote to memory of 3640 3016 Explorer.EXE cmstp.exe PID 3640 wrote to memory of 3680 3640 cmstp.exe cmd.exe PID 3640 wrote to memory of 3680 3640 cmstp.exe cmd.exe PID 3640 wrote to memory of 3680 3640 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3016-128-0x0000000006AA0000-0x0000000006BDB000-memory.dmpFilesize
1.2MB
-
memory/3016-135-0x0000000006920000-0x00000000069DE000-memory.dmpFilesize
760KB
-
memory/3260-116-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/3260-117-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/3260-118-0x00000000054C0000-0x0000000005552000-memory.dmpFilesize
584KB
-
memory/3260-119-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/3260-120-0x0000000008AB0000-0x0000000008AB1000-memory.dmpFilesize
4KB
-
memory/3260-121-0x0000000005A00000-0x0000000005A07000-memory.dmpFilesize
28KB
-
memory/3260-122-0x0000000008D20000-0x0000000008D7F000-memory.dmpFilesize
380KB
-
memory/3260-123-0x000000000B4B0000-0x000000000B4DA000-memory.dmpFilesize
168KB
-
memory/3260-114-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/3476-125-0x000000000041D040-mapping.dmp
-
memory/3476-126-0x00000000011F0000-0x0000000001510000-memory.dmpFilesize
3.1MB
-
memory/3476-127-0x00000000010E0000-0x00000000010F0000-memory.dmpFilesize
64KB
-
memory/3476-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3640-129-0x0000000000000000-mapping.dmp
-
memory/3640-132-0x0000000002DB0000-0x0000000002DD8000-memory.dmpFilesize
160KB
-
memory/3640-133-0x0000000004FD0000-0x00000000052F0000-memory.dmpFilesize
3.1MB
-
memory/3640-131-0x0000000000D60000-0x0000000000D76000-memory.dmpFilesize
88KB
-
memory/3640-134-0x0000000004D20000-0x0000000004DAF000-memory.dmpFilesize
572KB
-
memory/3680-130-0x0000000000000000-mapping.dmp