Analysis
-
max time kernel
36s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:49
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-20220414-en
General
-
Target
Swift Copy.exe
-
Size
341KB
-
MD5
b864067e3fa697652752fcd54f2b0621
-
SHA1
b9c2af989e2a4665df92e734bf7e1894ad9b873f
-
SHA256
9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
-
SHA512
6e37f92c0833881d8a533e5d696d536af4c10b0b835f5c65d979961a07784ea70ca9ae2942248a32251a892eef296e6c5f9f19ebf71d373320cb5e78a1d8eac5
Malware Config
Extracted
netwire
185.244.29.161:1591
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
NeiqFfto
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/956-63-0x0000000000400000-0x0000000000430000-memory.dmp netwire behavioral1/memory/956-64-0x0000000000400000-0x0000000000430000-memory.dmp netwire behavioral1/memory/956-66-0x0000000000400000-0x0000000000430000-memory.dmp netwire behavioral1/memory/956-68-0x000000000040242D-mapping.dmp netwire behavioral1/memory/956-67-0x0000000000400000-0x0000000000430000-memory.dmp netwire behavioral1/memory/956-72-0x0000000000400000-0x0000000000430000-memory.dmp netwire behavioral1/memory/956-74-0x0000000000400000-0x0000000000430000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
svhost.exeHost.exepid process 956 svhost.exe 1980 Host.exe -
Loads dropped DLL 3 IoCs
Processes:
Swift Copy.exesvhost.exepid process 1824 Swift Copy.exe 956 svhost.exe 1824 Swift Copy.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift Copy.exedescription pid process target process PID 1824 set thread context of 956 1824 Swift Copy.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 884 timeout.exe -
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Swift Copy.exepid process 1824 Swift Copy.exe 1824 Swift Copy.exe 1824 Swift Copy.exe 1824 Swift Copy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Swift Copy.exedescription pid process Token: SeDebugPrivilege 1824 Swift Copy.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
Swift Copy.exesvhost.execmd.execmd.exedescription pid process target process PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 1824 wrote to memory of 956 1824 Swift Copy.exe svhost.exe PID 956 wrote to memory of 1980 956 svhost.exe Host.exe PID 956 wrote to memory of 1980 956 svhost.exe Host.exe PID 956 wrote to memory of 1980 956 svhost.exe Host.exe PID 956 wrote to memory of 1980 956 svhost.exe Host.exe PID 1824 wrote to memory of 1764 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1764 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1764 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1764 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1312 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1312 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1312 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1312 1824 Swift Copy.exe cmd.exe PID 1312 wrote to memory of 1600 1312 cmd.exe reg.exe PID 1312 wrote to memory of 1600 1312 cmd.exe reg.exe PID 1312 wrote to memory of 1600 1312 cmd.exe reg.exe PID 1312 wrote to memory of 1600 1312 cmd.exe reg.exe PID 1824 wrote to memory of 1544 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1544 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1544 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 1544 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 760 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 760 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 760 1824 Swift Copy.exe cmd.exe PID 1824 wrote to memory of 760 1824 Swift Copy.exe cmd.exe PID 760 wrote to memory of 884 760 cmd.exe timeout.exe PID 760 wrote to memory of 884 760 cmd.exe timeout.exe PID 760 wrote to memory of 884 760 cmd.exe timeout.exe PID 760 wrote to memory of 884 760 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Swift Copy.exe" "%temp%\FolderN\name.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
341KB
MD5b864067e3fa697652752fcd54f2b0621
SHA1b9c2af989e2a4665df92e734bf7e1894ad9b873f
SHA2569b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
SHA5126e37f92c0833881d8a533e5d696d536af4c10b0b835f5c65d979961a07784ea70ca9ae2942248a32251a892eef296e6c5f9f19ebf71d373320cb5e78a1d8eac5
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.batFilesize
204B
MD5bfcbf382f036462e63f307ca4ae280c7
SHA1ffe98d15fa5ea205220d6bc105e317253a6ea003
SHA2562c3dd84c3ce3e529117e611d8caf4fc7f5a902840350f4ca524c251a2152c727
SHA5121b912652cc989541b396df5fd6bf207a4cf4ed891dc6e3223b8d0497c19a2589cb644c4c96ca01d882a7643f240c566966d84e46d77e9ad33e05214f8f553d16
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
2.6MB
MD51f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
2.6MB
MD51f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
2.6MB
MD51f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
2.6MB
MD51f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
341KB
MD5b864067e3fa697652752fcd54f2b0621
SHA1b9c2af989e2a4665df92e734bf7e1894ad9b873f
SHA2569b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
SHA5126e37f92c0833881d8a533e5d696d536af4c10b0b835f5c65d979961a07784ea70ca9ae2942248a32251a892eef296e6c5f9f19ebf71d373320cb5e78a1d8eac5
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
2.6MB
MD51f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
2.6MB
MD51f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
memory/760-85-0x0000000000000000-mapping.dmp
-
memory/884-87-0x0000000000000000-mapping.dmp
-
memory/956-63-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-59-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-72-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-68-0x000000000040242D-mapping.dmp
-
memory/956-74-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-66-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-58-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-64-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-67-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-61-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1312-80-0x0000000000000000-mapping.dmp
-
memory/1544-84-0x0000000000000000-mapping.dmp
-
memory/1600-81-0x0000000000000000-mapping.dmp
-
memory/1764-79-0x0000000000000000-mapping.dmp
-
memory/1824-54-0x0000000000F70000-0x0000000000FCC000-memory.dmpFilesize
368KB
-
memory/1824-56-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1824-55-0x0000000000950000-0x000000000097E000-memory.dmpFilesize
184KB
-
memory/1980-76-0x0000000000000000-mapping.dmp