1a03ef8677042233f7bd4ba09c35eb55a3dfb538cc94063638758ee5fdb08779

General

Target

swift.exe
Size

136KB
MD5

198cd80e37da0dbbaf969749e7ea1f9c
SHA1

d6e5dcad5b0ceae5db56d62750554d69e9c569b2
SHA256

2fe7660d58b881541c1f929382f478d19f17fdb56f2e8b313b8cfc0545a615bd
SHA512

f5d509e4ee75878f079109e4b8a056f850b67587b92e6d088e66bd79c05fdedaafb379b00d6e950bd7ab9f129351ec7be0aa911c5722254b2ea6e7eb3fc02b9d

Score

10^/10

collection persistence spyware stealer suricata

Malware Config

Signatures

suricata: ET MALWARE AgentTesla PWS HTTP CnC Checkin
suricata: ET MALWARE AgentTesla PWS HTTP CnC Checkin
suricata
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

swift.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swift.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swift.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swift.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

swift.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tregain = "C:\\Users\\Admin\\AppData\\Roaming\\Products\\WinDecode.exe"	swift.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

swift.exe

description pid process target process

PID 3884 set thread context of 4224 3884 swift.exe swift.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

swift.exe

pid process

4224 swift.exe
4224 swift.exe
4224 swift.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

swift.exeswift.exe

description pid process

Token: SeDebugPrivilege 3884 swift.exe
Token: SeDebugPrivilege 4224 swift.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

swift.exe

pid process

4224 swift.exe

flow	ioc
16	checkip.dyndns.org

description	pid	process	target process
PID 3884 set thread context of 4224	3884	swift.exe	swift.exe

pid	process
4224	swift.exe
4224	swift.exe
4224	swift.exe

description	pid	process
Token: SeDebugPrivilege	3884	swift.exe
Token: SeDebugPrivilege	4224	swift.exe

pid	process
4224	swift.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

swift.exe

description	pid	process	target process
PID 3884 wrote to memory of 4224	3884	swift.exe	swift.exe
PID 3884 wrote to memory of 4224	3884	swift.exe	swift.exe
PID 3884 wrote to memory of 4224	3884	swift.exe	swift.exe
PID 3884 wrote to memory of 4224	3884	swift.exe	swift.exe
PID 3884 wrote to memory of 4224	3884	swift.exe	swift.exe
PID 3884 wrote to memory of 4224	3884	swift.exe	swift.exe
PID 3884 wrote to memory of 4224	3884	swift.exe	swift.exe
PID 3884 wrote to memory of 4224	3884	swift.exe	swift.exe

outlook_office_path 1 IoCs

Processes:

swift.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swift.exe

outlook_win_path 1 IoCs

Processes:

swift.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	swift.exe

C:\Users\Admin\AppData\Local\Temp\swift.exe
"C:\Users\Admin\AppData\Local\Temp\swift.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884

C:\Users\Admin\AppData\Local\Temp\swift.exe
"C:\Users\Admin\AppData\Local\Temp\swift.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3884-130-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4224-132-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4224-131-0x0000000000000000-mapping.dmp

Download
memory/4224-133-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads