Analysis
- max time kernel
163s - max time network
170s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
Swift copy payment.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Swift copy payment.exe
- Size 837KB
- Sample220217-glw2rahga3
- SHA256 b5ca813a9176c8f6eb9394308c56858d9e27300f9c5a75c82eceae96b8defd83
- MD5 2a435fc967d5178a1d6377a07c833b68
- SHA1 61789ecbc2362ed7bb80eb2e86c009b889585987
- SHA512 b5f66a524e0da56fdd863ec035a3f6339dc8ae911b67ac0d75dfeecc3f908cc430dcfbbdade002df81b43c439ac0d397e3bf339cc5f36cf589b502730e11b726
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
6dmq
Decoy
-
christiealana.com
-
blogs.quest
-
canwasysce.com
-
0e1.biz
-
smart2b.online
-
piter.host
-
shravanti.com
-
1h2.space
-
whimsicalprinting.com
-
whippse.com
-
pillarbox-studio.art
-
yekanahtartuning.com
-
shopallaboutbaby.com
-
markarge.com
-
studio-orleen.com
-
rabinotis.quest
-
yuthukam.com
-
autosalesjax.info
-
medicestryllc.com
-
zip2me.com
-
thekushionz.com
-
gate334.com
-
icloud-app-fmi.info
-
sparrowoutdoor.com
-
uuhueef.xyz
-
131inwood.com
-
butterflysalonsuite.com
-
mariannecastlesas.com
-
yeji16.com
-
jys86863.com
-
center-fix.online
-
sugarbobotea.com
-
makemoneyfastdieyoung.com
-
498141.com
-
hartmaner.xyz
-
lastsexe.com
-
g1novasaude.online
-
thedanishmorelproject.com
-
twozilla.com
-
kashima-kodomo-fes.com
-
mmadude.com
-
suddennnnnnnnnnnn36.xyz
-
imagesdream.com
-
zzgsflgw.com
-
bedivere-lb.com
-
pt-roswell.com
-
52byhx.com
-
webdesignni.com
-
dlofs.rest
-
docomoam.xyz
-
wuzhuiso.com
-
appsforbusiness.pro
-
meteordrive.com
-
virtualfirstmonday.com
-
posyda.online
-
leojrlandscaplng.com
-
expert-formations.com
-
islaverauae.com
-
fgvelvole.com
-
selerarodjo.com
-
qvgmwqmsg.biz
-
studiostoon.com
-
organicpin.com
-
endosstore.com
-
petzgadgets.com
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/2468-140-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4680-148-0x0000000000F00000-0x0000000000F29000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 408 set thread context of 2468 408 Swift copy payment.exe 102 PID 2468 set thread context of 2264 2468 Swift copy payment.exe 55 PID 4680 set thread context of 2264 4680 cscript.exe 55 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 2468 Swift copy payment.exe 2468 Swift copy payment.exe 2468 Swift copy payment.exe 2468 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 408 Swift copy payment.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe 4680 cscript.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2468 Swift copy payment.exe 2468 Swift copy payment.exe 2468 Swift copy payment.exe 4680 cscript.exe 4680 cscript.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1680 svchost.exe Token: SeCreatePagefilePrivilege 1680 svchost.exe Token: SeShutdownPrivilege 1680 svchost.exe Token: SeCreatePagefilePrivilege 1680 svchost.exe Token: SeShutdownPrivilege 1680 svchost.exe Token: SeCreatePagefilePrivilege 1680 svchost.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe Token: SeRestorePrivilege 2896 TiWorker.exe Token: SeSecurityPrivilege 2896 TiWorker.exe Token: SeBackupPrivilege 2896 TiWorker.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 408 wrote to memory of 4864 408 Swift copy payment.exe 100 PID 408 wrote to memory of 4864 408 Swift copy payment.exe 100 PID 408 wrote to memory of 4864 408 Swift copy payment.exe 100 PID 408 wrote to memory of 4572 408 Swift copy payment.exe 101 PID 408 wrote to memory of 4572 408 Swift copy payment.exe 101 PID 408 wrote to memory of 4572 408 Swift copy payment.exe 101 PID 408 wrote to memory of 2468 408 Swift copy payment.exe 102 PID 408 wrote to memory of 2468 408 Swift copy payment.exe 102 PID 408 wrote to memory of 2468 408 Swift copy payment.exe 102 PID 408 wrote to memory of 2468 408 Swift copy payment.exe 102 PID 408 wrote to memory of 2468 408 Swift copy payment.exe 102 PID 408 wrote to memory of 2468 408 Swift copy payment.exe 102 PID 2264 wrote to memory of 4680 2264 Explorer.EXE 103 PID 2264 wrote to memory of 4680 2264 Explorer.EXE 103 PID 2264 wrote to memory of 4680 2264 Explorer.EXE 103 PID 4680 wrote to memory of 2496 4680 cscript.exe 104 PID 4680 wrote to memory of 2496 4680 cscript.exe 104 PID 4680 wrote to memory of 2496 4680 cscript.exe 104
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"3⤵PID:4864
-
-
C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"3⤵PID:4572
-
-
C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2468
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"3⤵PID:2496
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2896