Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
11-11-2021 06:43
Static task
static1
Behavioral task
behavioral1
Sample
swift.exe
Resource
win7-en-20211104
General
-
Target
swift.exe
-
Size
838KB
-
MD5
dae40883df63939076b90643ea59bc79
-
SHA1
cb5d1491347cc417bcc1d1e4090c8d6da787daec
-
SHA256
9f1a46f25ff46ddc69bb64b4bffbf628e41eb6c4820c617bfb06fd287e8cd08a
-
SHA512
a709fceca7430ae88e4d2d68bb166337820519293fbad8ec118c132ba0cf04872f75d3d27876a2589f8c6db31eee368f1882c9a5a654821370a0ffea4820cb8a
Malware Config
Extracted
xloader
2.5
rqan
http://www.cardboutiqueapp.com/rqan/
panda.wiki
gailkannamassage.com
ungravitystudio.com
coraggiomusicschool.com
51walkerstreetrippleside.com
infemax.store
mapara-foundation.net
elitespeedwaxs.com
manateeprint.com
thelocksmithtradeshow.com
phoenix-out-of-ashes.com
marionkgregory.store
abasketofwords.com
century21nokta.com
anthonyaarnold.com
forevermyanmar.com
ramashi.com
uniquecarbonbrush.com
packecco.com
appelnacrtl.quest
mayo-group.com
healthychefla.com
chuhaitalk.com
promoapp12.com
sergomosta.com
missuniversepr.com
onfinan.com
moyue27.com
miaocharge.com
hubmedia.digital
sarasota-pressurewashing.com
deliciousrecipe.xyz
rosalia-pilates-angers.com
qqsmt09.com
comercialjyv.com
ismarthings.com
b8ceex.com
reviewbyornex.online
familylovmix.com
wurzelwerk-sk.com
buratacoin.com
delocdinh.com
paraspikakasino.com
buyinsurance24.com
d1storesa.com
apollonfitnessvrn.club
tokofebri.store
cambabez.xyz
pointcon.net
digitalcoursepreneur.com
15dgj.xyz
mg-garage.com
claggs.com
yuezhong66.com
uvowtae.xyz
puutuisossa.quest
glitchpunks.art
haferssippe.quest
ucwykl.biz
finlandtwo.xyz
efterpisart.com
usbankofamerican.com
bamubusinesssolutions.com
lakshhomesbalram.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/776-61-0x0000000000000000-mapping.dmp xloader behavioral1/memory/776-64-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/776-68-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/944-73-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
swift.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ugzrspqk = "C:\\Users\\Public\\kqpsrzgU.url" swift.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
logagent.exehelp.exedescription pid process target process PID 776 set thread context of 1300 776 logagent.exe Explorer.EXE PID 776 set thread context of 1300 776 logagent.exe Explorer.EXE PID 944 set thread context of 1300 944 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
logagent.exehelp.exepid process 776 logagent.exe 776 logagent.exe 776 logagent.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe 944 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
logagent.exehelp.exepid process 776 logagent.exe 776 logagent.exe 776 logagent.exe 776 logagent.exe 944 help.exe 944 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.exehelp.exedescription pid process Token: SeDebugPrivilege 776 logagent.exe Token: SeDebugPrivilege 944 help.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
swift.exelogagent.exedescription pid process target process PID 1592 wrote to memory of 776 1592 swift.exe logagent.exe PID 1592 wrote to memory of 776 1592 swift.exe logagent.exe PID 1592 wrote to memory of 776 1592 swift.exe logagent.exe PID 1592 wrote to memory of 776 1592 swift.exe logagent.exe PID 1592 wrote to memory of 776 1592 swift.exe logagent.exe PID 1592 wrote to memory of 776 1592 swift.exe logagent.exe PID 1592 wrote to memory of 776 1592 swift.exe logagent.exe PID 776 wrote to memory of 944 776 logagent.exe help.exe PID 776 wrote to memory of 944 776 logagent.exe help.exe PID 776 wrote to memory of 944 776 logagent.exe help.exe PID 776 wrote to memory of 944 776 logagent.exe help.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\swift.exe"C:\Users\Admin\AppData\Local\Temp\swift.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-66-0x00000000001B0000-0x00000000001C1000-memory.dmpFilesize
68KB
-
memory/776-69-0x0000000000230000-0x0000000000241000-memory.dmpFilesize
68KB
-
memory/776-68-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/776-58-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/776-59-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/776-61-0x0000000000000000-mapping.dmp
-
memory/776-64-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/776-65-0x0000000002170000-0x0000000002473000-memory.dmpFilesize
3.0MB
-
memory/776-63-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/944-73-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/944-71-0x0000000000000000-mapping.dmp
-
memory/944-72-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/944-74-0x00000000009B0000-0x0000000000CB3000-memory.dmpFilesize
3.0MB
-
memory/944-75-0x0000000000450000-0x00000000004E0000-memory.dmpFilesize
576KB
-
memory/1300-67-0x00000000070C0000-0x00000000071D9000-memory.dmpFilesize
1.1MB
-
memory/1300-70-0x00000000064A0000-0x0000000006554000-memory.dmpFilesize
720KB
-
memory/1300-76-0x00000000071E0000-0x0000000007358000-memory.dmpFilesize
1.5MB
-
memory/1592-57-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB
-
memory/1592-56-0x0000000000251000-0x0000000000265000-memory.dmpFilesize
80KB
-
memory/1592-55-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB