Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy Pdf.exe
Resource
win7-20220414-en
General
-
Target
Swift Copy Pdf.exe
-
Size
324KB
-
MD5
9a426dc20fda9d009e9420df7b25d4be
-
SHA1
ee1b322966cc4c1c51a2d2cdf42146b9df551a0d
-
SHA256
a50d19ddd0b87fdc2529cfb1676f14297125443103286553fbcdf4ffa989f8e7
-
SHA512
21d19354008766a248a29ddeedfdf46320dd78fb478d480f941d47ea48028ca8843c816013d95ecec84c7fbe14bc1917fde1658b74cc54abaee93edfd065fd24
Malware Config
Extracted
formbook
3.9
h0d
goredfriday.com
ez-sleep.com
xydrgzx.com
paintersjacksonville.com
878212315.com
hotchatcams.com
cavalierwebsolutions.com
spirituellleben.com
emeraldjaya.com
dxyuq.info
rupturefarms.info
cajunnavygear.com
fsqdi.info
thegettinplacewhy.com
z0oav.com
conceptionfitness.com
kraftinvest.info
youngpeoplefutureofnews.com
cvmascotas.net
mundoconnection.com
bionsecurity.info
copytoken.com
zdsyzy.com
ucoktiket.com
karihunter.net
asierfilms.com
boycottsprouts.com
etceterar.net
publicsquaremarket.com
eqy7g0.win
berspume.com
ssluav30.com
fontainedantan.com
codycrossanswer.com
jyptzs.com
freethecbd.love
mizcupcake.com
cesarxes.com
hobecogroup.com
jodistreats.com
lvtejie.com
10f9.com
tradehut.group
stonewoodestates.com
ft9tr.com
hotel-lao.com
aberrant.solutions
nonduality.party
jisenwang.com
jp-rechtsanwaelte.com
bornes-de-paiement.com
osy-pcb.com
calcalthegrey.com
abckreativ.com
kayamanagement.com
vivezpratique.com
freie-rituale.com
echtehandarbeit.net
goforpromo.com
mydz88.com
zsauces.com
nco7978.com
ddlearn.com
paternosterhikingtrails.com
godhep.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3704-132-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4852-139-0x0000000000FD0000-0x0000000000FFA000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\R8_LGHTHNX_ = "C:\\Program Files (x86)\\F3f6hzl\\bhl0j_hkpt.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Swift Copy Pdf.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Swift Copy Pdf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Swift Copy Pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Swift Copy Pdf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Swift Copy Pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Swift Copy Pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Swift Copy Pdf.exeSwift Copy Pdf.exeexplorer.exedescription pid process target process PID 4772 set thread context of 3704 4772 Swift Copy Pdf.exe Swift Copy Pdf.exe PID 3704 set thread context of 2652 3704 Swift Copy Pdf.exe Explorer.EXE PID 4852 set thread context of 2652 4852 explorer.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Program Files (x86)\F3f6hzl\bhl0j_hkpt.exe explorer.exe -
Processes:
explorer.exedescription ioc process Key created \Registry\User\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
Swift Copy Pdf.exeexplorer.exepid process 3704 Swift Copy Pdf.exe 3704 Swift Copy Pdf.exe 3704 Swift Copy Pdf.exe 3704 Swift Copy Pdf.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe 4852 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2652 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Swift Copy Pdf.exeexplorer.exepid process 3704 Swift Copy Pdf.exe 3704 Swift Copy Pdf.exe 3704 Swift Copy Pdf.exe 4852 explorer.exe 4852 explorer.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Swift Copy Pdf.exeexplorer.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3704 Swift Copy Pdf.exe Token: SeDebugPrivilege 4852 explorer.exe Token: SeShutdownPrivilege 2652 Explorer.EXE Token: SeCreatePagefilePrivilege 2652 Explorer.EXE Token: SeShutdownPrivilege 2652 Explorer.EXE Token: SeCreatePagefilePrivilege 2652 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Swift Copy Pdf.exeExplorer.EXEexplorer.exedescription pid process target process PID 4772 wrote to memory of 3704 4772 Swift Copy Pdf.exe Swift Copy Pdf.exe PID 4772 wrote to memory of 3704 4772 Swift Copy Pdf.exe Swift Copy Pdf.exe PID 4772 wrote to memory of 3704 4772 Swift Copy Pdf.exe Swift Copy Pdf.exe PID 4772 wrote to memory of 3704 4772 Swift Copy Pdf.exe Swift Copy Pdf.exe PID 4772 wrote to memory of 3704 4772 Swift Copy Pdf.exe Swift Copy Pdf.exe PID 4772 wrote to memory of 3704 4772 Swift Copy Pdf.exe Swift Copy Pdf.exe PID 2652 wrote to memory of 4852 2652 Explorer.EXE explorer.exe PID 2652 wrote to memory of 4852 2652 Explorer.EXE explorer.exe PID 2652 wrote to memory of 4852 2652 Explorer.EXE explorer.exe PID 4852 wrote to memory of 3288 4852 explorer.exe cmd.exe PID 4852 wrote to memory of 3288 4852 explorer.exe cmd.exe PID 4852 wrote to memory of 3288 4852 explorer.exe cmd.exe PID 4852 wrote to memory of 1068 4852 explorer.exe cmd.exe PID 4852 wrote to memory of 1068 4852 explorer.exe cmd.exe PID 4852 wrote to memory of 1068 4852 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy Pdf.exe"2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy Pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3704 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy Pdf.exe"3⤵PID:3288
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
Filesize
81KB
MD54a1b6c6b4b2a1d374143815d28669fe7
SHA1f3fb3aebdd70eab3b9047b19d88e5f1f14599558
SHA2566323f97307e69b6a303362b90c233ac3ece144d2cb6aa96f71d0cc6098f7155c
SHA512e4a0fddd3add2720911d8fab699b97a7974cddc70b3d1dc4e71e8a14aae02b092d2fbf3fa72a399061d68feb5be27f429484d433ccd910c73cb338e6e0cbb115
-
Filesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4