Analysis
-
max time kernel
101s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-09-2021 06:26
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Swift Copy.exe
Resource
win10v20210408
General
-
Target
Swift Copy.exe
-
Size
797KB
-
MD5
f4e3db4de0dfb56c9ce9a90a597914ad
-
SHA1
f14504642cff022e5edb1709bff3ba799f683c24
-
SHA256
7fcc227a274b3d5e1490799223181c246178a676b12de3c1c59d6a5d675febb7
-
SHA512
c5914f96debcecf426467a708ddd03e73e635d11c66aad9a7460c60a08f50e6aeed0d5ca7401527380c861ab398ca400b3d5622bf0c3b16acdf5427e03572269
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.diva-italia.com - Port:
587 - Username:
info@diva-italia.com - Password:
rr.@%5LjgLz7
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1020-118-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1020-119-0x000000000043761E-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift Copy.exedescription pid process target process PID 4800 set thread context of 1020 4800 Swift Copy.exe Swift Copy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Swift Copy.exedw20.exepid process 4800 Swift Copy.exe 3596 dw20.exe 3596 dw20.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Swift Copy.exedw20.exedescription pid process Token: SeDebugPrivilege 4800 Swift Copy.exe Token: SeRestorePrivilege 3596 dw20.exe Token: SeBackupPrivilege 3596 dw20.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Swift Copy.exeSwift Copy.exedescription pid process target process PID 4800 wrote to memory of 5108 4800 Swift Copy.exe schtasks.exe PID 4800 wrote to memory of 5108 4800 Swift Copy.exe schtasks.exe PID 4800 wrote to memory of 5108 4800 Swift Copy.exe schtasks.exe PID 4800 wrote to memory of 1020 4800 Swift Copy.exe Swift Copy.exe PID 4800 wrote to memory of 1020 4800 Swift Copy.exe Swift Copy.exe PID 4800 wrote to memory of 1020 4800 Swift Copy.exe Swift Copy.exe PID 4800 wrote to memory of 1020 4800 Swift Copy.exe Swift Copy.exe PID 4800 wrote to memory of 1020 4800 Swift Copy.exe Swift Copy.exe PID 4800 wrote to memory of 1020 4800 Swift Copy.exe Swift Copy.exe PID 4800 wrote to memory of 1020 4800 Swift Copy.exe Swift Copy.exe PID 4800 wrote to memory of 1020 4800 Swift Copy.exe Swift Copy.exe PID 1020 wrote to memory of 3596 1020 Swift Copy.exe dw20.exe PID 1020 wrote to memory of 3596 1020 Swift Copy.exe dw20.exe PID 1020 wrote to memory of 3596 1020 Swift Copy.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JNZVRO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF293.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 6963⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Swift Copy.exe.logMD5
5e7bb97636a484b5a87e60373614279a
SHA136bfdec32eedb141a4a106d89a453326f62593ee
SHA25612ed6e1df2c57556c59dfd6630fd454a9df76166f340c41ee6bc54d98e709e20
SHA512448c62d538e646045d7315ff902b86f614e2dc1eb0959c22c6618fd2c8767c330d24692357559310e6b55b0c35415a14a6ab2d6d9b8d2a03186949b97190fd56
-
C:\Users\Admin\AppData\Local\Temp\tmpF293.tmpMD5
2d0977734e771cd7ef557057bf9e3d2a
SHA18ea9d61630c71636df8ad595efe0ad22d6b22894
SHA256c1243551fb1fb0df1db0ca4cad8bcf43a8c7fa7ad2e068e46b275fddc8798b13
SHA512e85a6b6e05d5f3b9d376399e755c19201a9e066c2abec5cfb249c4cbef7b9af6e47e61bcb1416ee69610855c5c485265eeaf3659cff5db2dbcbdbd10b99b02f2
-
memory/1020-118-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1020-119-0x000000000043761E-mapping.dmp
-
memory/1020-122-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/3596-121-0x0000000000000000-mapping.dmp
-
memory/4800-114-0x0000000002BF0000-0x0000000002BF1000-memory.dmpFilesize
4KB
-
memory/4800-115-0x0000000002BF1000-0x0000000002BF2000-memory.dmpFilesize
4KB
-
memory/5108-116-0x0000000000000000-mapping.dmp