Analysis
-
max time kernel
125s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 02:27
Static task
static1
Behavioral task
behavioral1
Sample
Swift.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Swift.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
Swift.exe
-
Size
385KB
-
MD5
5a4e899e1f72d8036da67d3840d24a89
-
SHA1
138d2f78425306696c78f22d4ee83323f6af7a10
-
SHA256
3080bf75b34e9b440154d8f35f7e8c5bd111995869118a093f81b56583f7c03b
-
SHA512
9bd07135e613239c980418e703e4655a6239119dea0373188b0e6847dfe0e034726e1c3274aabe1cda5d855857dd9da08e8614b379fd4de0ab0728c16a270d45
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
js}$_IlwF1q4
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1224-59-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1224-60-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1224-61-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1224-62-0x0000000000445C3E-mapping.dmp family_agenttesla behavioral1/memory/1224-64-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1224-66-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift.exedescription pid process target process PID 1464 set thread context of 1224 1464 Swift.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Swift.exeRegSvcs.exepid process 1464 Swift.exe 1224 RegSvcs.exe 1224 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Swift.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1464 Swift.exe Token: SeDebugPrivilege 1224 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Swift.exedescription pid process target process PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe PID 1464 wrote to memory of 1224 1464 Swift.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift.exe"C:\Users\Admin\AppData\Local\Temp\Swift.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-56-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1224-57-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1224-59-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1224-60-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1224-61-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1224-62-0x0000000000445C3E-mapping.dmp
-
memory/1224-64-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1224-66-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1224-68-0x0000000074B40000-0x00000000750EB000-memory.dmpFilesize
5.7MB
-
memory/1464-54-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB
-
memory/1464-55-0x0000000074B40000-0x00000000750EB000-memory.dmpFilesize
5.7MB