Analysis
-
max time kernel
601s -
max time network
600s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
27-09-2021 03:06
Static task
static1
Behavioral task
behavioral1
Sample
swift_copy_MT103_pdf.exe
Resource
win7-en-20210920
General
-
Target
swift_copy_MT103_pdf.exe
-
Size
501KB
-
MD5
1c620763897a2166e17aab168bcf0d09
-
SHA1
5d3d29ab6ec3f5e4d80f188d15a97002347ea6de
-
SHA256
98cd8d900722c5903311d5c8e6a64333fa8bcda553cef3c872ba54a74c6ee47e
-
SHA512
a631295724d1896dba791db58d2d370bf1330ab57f328253294025f5695da05b7c3ec94192e48421a0c7d19899d9e3bed5aa96f61564d6183fb6857e4bf61077
Malware Config
Extracted
xloader
2.3
conv
http://www.7stepsmeal.com/conv/
hydrusgraphene.com
eastwindshomes.com
f1-holding.com
tomrings.com
nickysclosetnest.com
eckare88.com
southboundsupplies.com
asilar.net
ludiali.com
sarahasmussen.com
terreetmerphotography.com
tesserlink.com
xayxcq.com
jobforage.com
76leads.com
onyamarx.com
sandrinafloral.com
a5y7tvmr4.xyz
greatdanesuk.com
superbartendergigs.store
boca-azul.com
bullishsoftware.com
sarahsvirtualofficeteam.com
marketplacestuff.com
simphonya.com
jndzqp.com
testpcrcovid.com
iebcde.com
lfcaihua.com
calvalleysales.com
dunlapandmagee.com
carteddy.com
thelodgepotenza.com
ghoomakadh.com
electrifyitall.com
differentfm.com
ossengeconsulting.com
unisoftwaremarket.com
anhtens.com
anshangbao.com
aerie.sucks
iiotech.xyz
dawnbreakers-guild.com
operatechno.com
palacedepleasure.com
ronaldcraig.com
bangtou123.com
buildtocure.net
portaldoctortv.com
netblocks.exposed
vaiga.pro
serenitypieces.com
redefineyourwork.com
8961599.com
2meducate.com
metalandtubeimpex.com
reviewpayee.com
shopsmallbus.com
shinelogisticsllc.com
silverspiralshop.com
een.xyz
yixinliu.com
recyclewahine.com
gilltales.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2592-126-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2592-127-0x000000000041CFA0-mapping.dmp xloader behavioral2/memory/4360-135-0x0000000002150000-0x0000000002178000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
swift_copy_MT103_pdf.exeswift_copy_MT103_pdf.execontrol.exedescription pid process target process PID 3644 set thread context of 2592 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 2592 set thread context of 3048 2592 swift_copy_MT103_pdf.exe Explorer.EXE PID 2592 set thread context of 3048 2592 swift_copy_MT103_pdf.exe Explorer.EXE PID 4360 set thread context of 3048 4360 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
swift_copy_MT103_pdf.exeswift_copy_MT103_pdf.execontrol.exepid process 3644 swift_copy_MT103_pdf.exe 3644 swift_copy_MT103_pdf.exe 3644 swift_copy_MT103_pdf.exe 3644 swift_copy_MT103_pdf.exe 3644 swift_copy_MT103_pdf.exe 3644 swift_copy_MT103_pdf.exe 3644 swift_copy_MT103_pdf.exe 3644 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe 4360 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
swift_copy_MT103_pdf.execontrol.exepid process 2592 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 2592 swift_copy_MT103_pdf.exe 4360 control.exe 4360 control.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
swift_copy_MT103_pdf.exeswift_copy_MT103_pdf.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3644 swift_copy_MT103_pdf.exe Token: SeDebugPrivilege 2592 swift_copy_MT103_pdf.exe Token: SeDebugPrivilege 4360 control.exe Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
swift_copy_MT103_pdf.exeExplorer.EXEcontrol.exedescription pid process target process PID 3644 wrote to memory of 4072 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 4072 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 4072 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 1992 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 1992 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 1992 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 3500 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 3500 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 3500 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 4060 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 4060 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 4060 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 2592 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 2592 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 2592 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 2592 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 2592 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3644 wrote to memory of 2592 3644 swift_copy_MT103_pdf.exe swift_copy_MT103_pdf.exe PID 3048 wrote to memory of 4360 3048 Explorer.EXE control.exe PID 3048 wrote to memory of 4360 3048 Explorer.EXE control.exe PID 3048 wrote to memory of 4360 3048 Explorer.EXE control.exe PID 4360 wrote to memory of 4328 4360 control.exe cmd.exe PID 4360 wrote to memory of 4328 4360 control.exe cmd.exe PID 4360 wrote to memory of 4328 4360 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\swift_copy_MT103_pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2592-126-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2592-131-0x0000000000E80000-0x0000000000E90000-memory.dmpFilesize
64KB
-
memory/2592-128-0x00000000012B0000-0x00000000015D0000-memory.dmpFilesize
3.1MB
-
memory/2592-129-0x00000000009F0000-0x0000000000A00000-memory.dmpFilesize
64KB
-
memory/2592-127-0x000000000041CFA0-mapping.dmp
-
memory/3048-139-0x00000000049F0000-0x0000000004B0A000-memory.dmpFilesize
1.1MB
-
memory/3048-132-0x0000000002400000-0x00000000024C3000-memory.dmpFilesize
780KB
-
memory/3048-130-0x0000000000430000-0x00000000004EE000-memory.dmpFilesize
760KB
-
memory/3644-122-0x00000000090F0000-0x00000000090F1000-memory.dmpFilesize
4KB
-
memory/3644-119-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/3644-124-0x0000000009560000-0x00000000095C5000-memory.dmpFilesize
404KB
-
memory/3644-123-0x0000000009060000-0x0000000009067000-memory.dmpFilesize
28KB
-
memory/3644-115-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/3644-121-0x0000000005BC0000-0x0000000005BC1000-memory.dmpFilesize
4KB
-
memory/3644-120-0x0000000005510000-0x00000000055A2000-memory.dmpFilesize
584KB
-
memory/3644-125-0x000000000BD60000-0x000000000BD8E000-memory.dmpFilesize
184KB
-
memory/3644-118-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/3644-117-0x0000000005C00000-0x0000000005C01000-memory.dmpFilesize
4KB
-
memory/4328-136-0x0000000000000000-mapping.dmp
-
memory/4360-134-0x0000000000130000-0x0000000000150000-memory.dmpFilesize
128KB
-
memory/4360-135-0x0000000002150000-0x0000000002178000-memory.dmpFilesize
160KB
-
memory/4360-137-0x00000000042F0000-0x0000000004610000-memory.dmpFilesize
3.1MB
-
memory/4360-138-0x0000000004040000-0x00000000040CF000-memory.dmpFilesize
572KB
-
memory/4360-133-0x0000000000000000-mapping.dmp