Analysis
-
max time kernel
155s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30/04/2023, 21:52
Behavioral task
behavioral1
Sample
Swiftfn.exe
Resource
win7-20230220-en
General
-
Target
Swiftfn.exe
-
Size
47KB
-
MD5
25d7952b3e8c9f0872ecf4f099cea1a2
-
SHA1
976e307d3fc015452e70acd29ebddef0d8823fac
-
SHA256
7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
-
SHA512
f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
SSDEEP
768:sJCO9ILoeck+riPUl5kJN/QisVF8YbWgTgDaJivEgK/JDqVc6KN:sJ588kqFzbJga4nkJDqVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
dom45x.duckdns.org:62180
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
resource yara_rule behavioral1/memory/1420-54-0x0000000000E30000-0x0000000000E42000-memory.dmp asyncrat behavioral1/files/0x000a000000012354-66.dat asyncrat behavioral1/files/0x000a000000012354-67.dat asyncrat behavioral1/memory/1060-68-0x0000000000B90000-0x0000000000BA2000-memory.dmp asyncrat behavioral1/memory/1060-69-0x000000001B0F0000-0x000000001B170000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 1060 Runtime Broker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 388 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1832 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1420 Swiftfn.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1420 Swiftfn.exe Token: SeDebugPrivilege 1060 Runtime Broker.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1420 wrote to memory of 976 1420 Swiftfn.exe 28 PID 1420 wrote to memory of 976 1420 Swiftfn.exe 28 PID 1420 wrote to memory of 976 1420 Swiftfn.exe 28 PID 1420 wrote to memory of 440 1420 Swiftfn.exe 30 PID 1420 wrote to memory of 440 1420 Swiftfn.exe 30 PID 1420 wrote to memory of 440 1420 Swiftfn.exe 30 PID 976 wrote to memory of 388 976 cmd.exe 32 PID 976 wrote to memory of 388 976 cmd.exe 32 PID 976 wrote to memory of 388 976 cmd.exe 32 PID 440 wrote to memory of 1832 440 cmd.exe 33 PID 440 wrote to memory of 1832 440 cmd.exe 33 PID 440 wrote to memory of 1832 440 cmd.exe 33 PID 440 wrote to memory of 1060 440 cmd.exe 34 PID 440 wrote to memory of 1060 440 cmd.exe 34 PID 440 wrote to memory of 1060 440 cmd.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"'3⤵
- Creates scheduled task(s)
PID:388
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA130.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1832
-
-
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
158B
MD5f094e24751b4c554bbcb22503eab8a64
SHA12038a1f5191aa89f678ae8933609ea5cd1e29f50
SHA2563a71c41188456cd163735c604682a73582f9d6256a3799a1899dc65d702673bb
SHA512041f8ed6f34af770c66a7dd7460f7da4bb5f7df7de5aab35aa7b8c9eab8ad7e56f3b5f0b3dffcfd493406705159f00382d6a2ea805b16b42da8b88c6ac83f332
-
Filesize
158B
MD5f094e24751b4c554bbcb22503eab8a64
SHA12038a1f5191aa89f678ae8933609ea5cd1e29f50
SHA2563a71c41188456cd163735c604682a73582f9d6256a3799a1899dc65d702673bb
SHA512041f8ed6f34af770c66a7dd7460f7da4bb5f7df7de5aab35aa7b8c9eab8ad7e56f3b5f0b3dffcfd493406705159f00382d6a2ea805b16b42da8b88c6ac83f332
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb