Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
19-10-2021 20:37
General
-
Target
swif.exe
-
Size
440KB
-
MD5
ceae6fe1fbf29a7edc7e4bdc0fa1e90d
-
SHA1
0ce8bcf3606890d226454341edd131f025f11d3f
-
SHA256
e6ecdaef474a3ea4407eae99ea219723f686756f42cf6bcff199f34677be8a20
-
SHA512
50b3189b566cf32657510e9b67b90c4cc25e1ec107fdb6bf268bc5b333839dc854a8993ebb3f1a8457a80a89234931e09dbf11e20cc1cd4b0fbdcc709a222c0e
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\swif.exe"C:\Users\Admin\AppData\Local\Temp\swif.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swif.exe"C:\Users\Admin\AppData\Local\Temp\swif.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5083⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyF133.tmp\apcvw.dllMD5
d9a3dbd5ccd605e72789888cb1bd1070
SHA172d6ea339a1d9d2736d50df39379e5d001fc281a
SHA256c762e080806c747ed7629a1f870cf413b4bf68e4390899a79c27de90e010b7f2
SHA512199bce599d749a187157c8692d98fd03fc1f446726b241f3b1f1d3bdf6156095ad767c9b204e6df640484e801120a0befb8e574bd9917e22f39d12b2882f4ef4
-
memory/324-64-0x0000000000000000-mapping.dmp
-
memory/324-66-0x0000000002330000-0x0000000002331000-memory.dmpFilesize
4KB
-
memory/1404-55-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1404-56-0x000000000040188B-mapping.dmp
-
memory/1404-59-0x0000000001E60000-0x0000000001E61000-memory.dmpFilesize
4KB
-
memory/1404-60-0x0000000001E61000-0x0000000001E62000-memory.dmpFilesize
4KB
-
memory/1404-61-0x0000000001E62000-0x0000000001E64000-memory.dmpFilesize
8KB
-
memory/1404-62-0x0000000001E67000-0x0000000001E68000-memory.dmpFilesize
4KB
-
memory/1404-58-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1404-63-0x0000000001E68000-0x0000000001E69000-memory.dmpFilesize
4KB
-
memory/2024-53-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB