Analysis
-
max time kernel
49s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 00:49
Static task
static1
Behavioral task
behavioral1
Sample
Swift_Confirmation_Copy_PDF.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Swift_Confirmation_Copy_PDF.exe
Resource
win10v2004-20220812-en
General
-
Target
Swift_Confirmation_Copy_PDF.exe
-
Size
635KB
-
MD5
8f8997c46d2e2d5bacace89ddc5b98ea
-
SHA1
42936ce414491a0bdf4363e028e9acc809904828
-
SHA256
0e6d1760c730846071dff47ea51828caf0108d9dd72f472e0a29b7f06c880955
-
SHA512
fba79b3893726c6160f3d8cde09daf562dba7f6fd7de20575ab21093cc4effa93cb8de5638db56e6fc9fdc9419320cae5ae5d993465b48d3bd0ab23107efaa20
-
SSDEEP
12288:KP2ezBnLOkPRxliW1PjiZj5C23orXRU7uIjV8uqFgfjPe4lRvsc8ZR301P:y2exikPRrhGZjY24KNjuRWfFR
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1923344551:AAGJ9MeV4yHipzEdvvxVuepm8PFUNaCZez4/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions Swift_Confirmation_Copy_PDF.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools Swift_Confirmation_Copy_PDF.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Swift_Confirmation_Copy_PDF.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Swift_Confirmation_Copy_PDF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Swift_Confirmation_Copy_PDF.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift_Confirmation_Copy_PDF.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift_Confirmation_Copy_PDF.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift_Confirmation_Copy_PDF.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Swift_Confirmation_Copy_PDF.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Swift_Confirmation_Copy_PDF.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Swift_Confirmation_Copy_PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exedescription pid process target process PID 1064 set thread context of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exeSwift_Confirmation_Copy_PDF.exepowershell.exepid process 1064 Swift_Confirmation_Copy_PDF.exe 1064 Swift_Confirmation_Copy_PDF.exe 1524 Swift_Confirmation_Copy_PDF.exe 1524 Swift_Confirmation_Copy_PDF.exe 800 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exeSwift_Confirmation_Copy_PDF.exepowershell.exedescription pid process Token: SeDebugPrivilege 1064 Swift_Confirmation_Copy_PDF.exe Token: SeDebugPrivilege 1524 Swift_Confirmation_Copy_PDF.exe Token: SeDebugPrivilege 800 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exedescription pid process target process PID 1064 wrote to memory of 800 1064 Swift_Confirmation_Copy_PDF.exe powershell.exe PID 1064 wrote to memory of 800 1064 Swift_Confirmation_Copy_PDF.exe powershell.exe PID 1064 wrote to memory of 800 1064 Swift_Confirmation_Copy_PDF.exe powershell.exe PID 1064 wrote to memory of 800 1064 Swift_Confirmation_Copy_PDF.exe powershell.exe PID 1064 wrote to memory of 1352 1064 Swift_Confirmation_Copy_PDF.exe schtasks.exe PID 1064 wrote to memory of 1352 1064 Swift_Confirmation_Copy_PDF.exe schtasks.exe PID 1064 wrote to memory of 1352 1064 Swift_Confirmation_Copy_PDF.exe schtasks.exe PID 1064 wrote to memory of 1352 1064 Swift_Confirmation_Copy_PDF.exe schtasks.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe PID 1064 wrote to memory of 1524 1064 Swift_Confirmation_Copy_PDF.exe Swift_Confirmation_Copy_PDF.exe -
outlook_office_path 1 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift_Confirmation_Copy_PDF.exe -
outlook_win_path 1 IoCs
Processes:
Swift_Confirmation_Copy_PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Swift_Confirmation_Copy_PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift_Confirmation_Copy_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Swift_Confirmation_Copy_PDF.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AddJPyGJtsi.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AddJPyGJtsi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A39.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Swift_Confirmation_Copy_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Swift_Confirmation_Copy_PDF.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6A39.tmpFilesize
1KB
MD5da2ff6468204409e09951e40fe36347b
SHA141b4d48089c6442e5a99fca06ef3e48f1d044000
SHA2565c2a129ce5adb1abd1a664ad7118031f53e8db0e220df645da931fa742d78b91
SHA5125c69ea4b5af310dc1151e3765562e2087b65fad9b5fb17e02650a7e4a87bba7c04b02ef2c1cbdef1181d00a283004a0d615887e8d5bca851a1eea464a2200aa6
-
memory/800-59-0x0000000000000000-mapping.dmp
-
memory/800-77-0x000000006E860000-0x000000006EE0B000-memory.dmpFilesize
5.7MB
-
memory/800-76-0x000000006E860000-0x000000006EE0B000-memory.dmpFilesize
5.7MB
-
memory/1064-63-0x0000000004A60000-0x0000000004A9C000-memory.dmpFilesize
240KB
-
memory/1064-58-0x00000000071F0000-0x0000000007262000-memory.dmpFilesize
456KB
-
memory/1064-57-0x0000000000420000-0x000000000042A000-memory.dmpFilesize
40KB
-
memory/1064-54-0x00000000011E0000-0x0000000001286000-memory.dmpFilesize
664KB
-
memory/1064-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmpFilesize
8KB
-
memory/1064-56-0x00000000003F0000-0x0000000000406000-memory.dmpFilesize
88KB
-
memory/1352-60-0x0000000000000000-mapping.dmp
-
memory/1524-65-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1524-68-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1524-70-0x0000000000435CAE-mapping.dmp
-
memory/1524-69-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1524-72-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1524-74-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1524-67-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1524-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB