Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:39
Static task
static1
Behavioral task
behavioral1
Sample
Swift Doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Swift Doc.exe
Resource
win10v2004-20220414-en
General
-
Target
Swift Doc.exe
-
Size
281KB
-
MD5
6d5dbefe732e62fb5164fead6af6a887
-
SHA1
b3f19fa125a3e4f418a287f63f6b85e751c43396
-
SHA256
ca9be111c1e10b81ab16b5434474f09085c62d8d592fce7e79810aef284a675e
-
SHA512
d5ef89ccdc6db1898364243bc07771e442f5cc69518ea6f256706e7603d72cb813ec466fac23dd76c4ecde4072d82c9a60c89e1d9985c064780549aa2a242fed
Malware Config
Extracted
lokibot
http://beckhoff-th.com/kon/kon2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Swift Doc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Swift Doc.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Swift Doc.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Swift Doc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift Doc.exedescription pid process target process PID 4344 set thread context of 4508 4344 Swift Doc.exe Swift Doc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Swift Doc.exepid process 4508 Swift Doc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Swift Doc.exedescription pid process Token: SeDebugPrivilege 4508 Swift Doc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Swift Doc.exedescription pid process target process PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe PID 4344 wrote to memory of 4508 4344 Swift Doc.exe Swift Doc.exe -
outlook_office_path 1 IoCs
Processes:
Swift Doc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Swift Doc.exe -
outlook_win_path 1 IoCs
Processes:
Swift Doc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Swift Doc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Doc.exe"C:\Users\Admin\AppData\Local\Temp\Swift Doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift Doc.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4344-130-0x0000000000CE0000-0x0000000000D2C000-memory.dmpFilesize
304KB
-
memory/4344-131-0x0000000005CF0000-0x0000000006294000-memory.dmpFilesize
5.6MB
-
memory/4344-132-0x0000000005740000-0x00000000057D2000-memory.dmpFilesize
584KB
-
memory/4344-133-0x00000000056D0000-0x00000000056DA000-memory.dmpFilesize
40KB
-
memory/4344-134-0x0000000008070000-0x000000000810C000-memory.dmpFilesize
624KB
-
memory/4508-135-0x0000000000000000-mapping.dmp
-
memory/4508-136-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4508-138-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4508-139-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB