Analysis
-
max time kernel
150s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-07-2022 00:07
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Swift Copy.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Swift Copy.exe
-
Size
461KB
-
MD5
7c4e3e90c83dc1ce60a34ca9a1cb5fbd
-
SHA1
45cd96b6273430c6540fd51b811d46c1ca192d2e
-
SHA256
0fabbaf7f8ad7af3888aa77b2e376db74390064ea8eea0c54fee59fdc2cd54c8
-
SHA512
c79b983f7d84be227f6741bbe0b2cc73bcdb800528d898e52c4030a468c980a5b46a7c01c16a9bf7d78fd855a7982d525c562a04e5cc7804e0abdd585e700523
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
janet_maldonado@taiemerica.com - Password:
JuCbr%o3
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4532-136-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift Copy.exedescription pid process target process PID 4848 set thread context of 4532 4848 Swift Copy.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 4532 RegSvcs.exe 4532 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4532 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Swift Copy.exedescription pid process target process PID 4848 wrote to memory of 4532 4848 Swift Copy.exe RegSvcs.exe PID 4848 wrote to memory of 4532 4848 Swift Copy.exe RegSvcs.exe PID 4848 wrote to memory of 4532 4848 Swift Copy.exe RegSvcs.exe PID 4848 wrote to memory of 4532 4848 Swift Copy.exe RegSvcs.exe PID 4848 wrote to memory of 4532 4848 Swift Copy.exe RegSvcs.exe PID 4848 wrote to memory of 4532 4848 Swift Copy.exe RegSvcs.exe PID 4848 wrote to memory of 4532 4848 Swift Copy.exe RegSvcs.exe PID 4848 wrote to memory of 4532 4848 Swift Copy.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4532-135-0x0000000000000000-mapping.dmp
-
memory/4532-136-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4532-137-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4532-138-0x0000000006410000-0x0000000006460000-memory.dmpFilesize
320KB
-
memory/4848-130-0x0000000000690000-0x000000000070A000-memory.dmpFilesize
488KB
-
memory/4848-131-0x00000000056B0000-0x0000000005C54000-memory.dmpFilesize
5.6MB
-
memory/4848-132-0x0000000005100000-0x0000000005192000-memory.dmpFilesize
584KB
-
memory/4848-133-0x00000000050C0000-0x00000000050CA000-memory.dmpFilesize
40KB
-
memory/4848-134-0x0000000008B30000-0x0000000008BCC000-memory.dmpFilesize
624KB