Malware Analysis Report

2025-08-06 03:44

Sample ID 230430-1q9yyseh7w
Target Swiftfn.exe
SHA256 7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1

Threat Level: Known bad

The file Swiftfn.exe was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

Asyncrat family

AsyncRat

Async RAT payload

Async RAT payload

Checks computer location settings

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Delays execution with timeout.exe

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-30 21:52

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-30 21:52

Reported

2023-04-30 21:55

Platform

win7-20230220-en

Max time kernel

155s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime Broker.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Runtime Broker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1420 wrote to memory of 976 N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe C:\Windows\System32\cmd.exe
PID 1420 wrote to memory of 976 N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe C:\Windows\System32\cmd.exe
PID 1420 wrote to memory of 976 N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe C:\Windows\System32\cmd.exe
PID 1420 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe C:\Windows\system32\cmd.exe
PID 1420 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe C:\Windows\system32\cmd.exe
PID 1420 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe C:\Windows\system32\cmd.exe
PID 976 wrote to memory of 388 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 976 wrote to memory of 388 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 976 wrote to memory of 388 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 440 wrote to memory of 1832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 440 wrote to memory of 1832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 440 wrote to memory of 1832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 440 wrote to memory of 1060 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
PID 440 wrote to memory of 1060 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
PID 440 wrote to memory of 1060 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe

"C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"' & exit

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA130.tmp.bat""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"'

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 dom45x.duckdns.org udp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 8.8.8.8:53 dom45x.duckdns.org udp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp

Files

memory/1420-54-0x0000000000E30000-0x0000000000E42000-memory.dmp

memory/1420-55-0x000000001B050000-0x000000001B0D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA130.tmp.bat

MD5 f094e24751b4c554bbcb22503eab8a64
SHA1 2038a1f5191aa89f678ae8933609ea5cd1e29f50
SHA256 3a71c41188456cd163735c604682a73582f9d6256a3799a1899dc65d702673bb
SHA512 041f8ed6f34af770c66a7dd7460f7da4bb5f7df7de5aab35aa7b8c9eab8ad7e56f3b5f0b3dffcfd493406705159f00382d6a2ea805b16b42da8b88c6ac83f332

C:\Users\Admin\AppData\Local\Temp\tmpA130.tmp.bat

MD5 f094e24751b4c554bbcb22503eab8a64
SHA1 2038a1f5191aa89f678ae8933609ea5cd1e29f50
SHA256 3a71c41188456cd163735c604682a73582f9d6256a3799a1899dc65d702673bb
SHA512 041f8ed6f34af770c66a7dd7460f7da4bb5f7df7de5aab35aa7b8c9eab8ad7e56f3b5f0b3dffcfd493406705159f00382d6a2ea805b16b42da8b88c6ac83f332

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

MD5 25d7952b3e8c9f0872ecf4f099cea1a2
SHA1 976e307d3fc015452e70acd29ebddef0d8823fac
SHA256 7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512 f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

MD5 25d7952b3e8c9f0872ecf4f099cea1a2
SHA1 976e307d3fc015452e70acd29ebddef0d8823fac
SHA256 7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512 f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb

memory/1060-68-0x0000000000B90000-0x0000000000BA2000-memory.dmp

memory/1060-69-0x000000001B0F0000-0x000000001B170000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 e71c8443ae0bc2e282c73faead0a6dd3
SHA1 0c110c1b01e68edfacaeae64781a37b1995fa94b
SHA256 95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512 b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

C:\Users\Admin\AppData\Local\Temp\Tar6447.tmp

MD5 be2bec6e8c5653136d3e72fe53c98aa3
SHA1 a8182d6db17c14671c3d5766c72e58d87c0810de
SHA256 1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA512 0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-30 21:52

Reported

2023-04-30 21:55

Platform

win10v2004-20230220-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Runtime Broker.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\taskmgr.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E C:\Users\Admin\AppData\Roaming\Runtime Broker.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e1d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb13140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc662000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470033000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c05c0000000100000004000000800100002000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 C:\Users\Admin\AppData\Roaming\Runtime Broker.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Runtime Broker.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe

"C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDDE1.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"'

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
RU 193.3.19.154:80 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 192.229.211.108:80 tcp
US 8.8.8.8:53 dom45x.duckdns.org udp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 8.8.8.8:53 36.43.235.68.in-addr.arpa udp
US 8.8.8.8:53 cxcs.microsoft.net udp
US 204.79.197.200:443 www.bing.com tcp
NL 23.222.35.131:443 cxcs.microsoft.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 131.35.222.23.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 13.89.179.8:443 tcp
IE 20.54.89.15:443 tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 117.18.232.240:80 tcp
US 117.18.232.240:80 tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 dom45x.duckdns.org udp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 209.197.3.8:80 tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 8.8.8.8:53 dom45x.duckdns.org udp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp
US 68.235.43.36:62180 dom45x.duckdns.org tcp

Files

memory/1820-133-0x0000000000850000-0x0000000000862000-memory.dmp

memory/1820-134-0x000000001BF90000-0x000000001BFA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpDDE1.tmp.bat

MD5 790a6381e2ecbda785cbd8c83e2c6ac3
SHA1 81520165554b05e4b57a7361e62726795d891019
SHA256 2c9a846d04fefaeaa6cc26498514b2594f299b33e617b4a385a37453c7092015
SHA512 4be5d4b1ea824d998c725ca683a68f4ad479b0d00cd543385b077649ea9a4e8a8b4bddb20da2db6caf3d56ce9000996f5cb4476e7ea4e01c4559b4082f5b2007

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

MD5 25d7952b3e8c9f0872ecf4f099cea1a2
SHA1 976e307d3fc015452e70acd29ebddef0d8823fac
SHA256 7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512 f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

MD5 25d7952b3e8c9f0872ecf4f099cea1a2
SHA1 976e307d3fc015452e70acd29ebddef0d8823fac
SHA256 7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512 f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb

memory/4452-143-0x000000001B9F0000-0x000000001BA00000-memory.dmp

memory/4212-144-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-145-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-146-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-150-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-156-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-155-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-154-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-153-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-152-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4212-151-0x000001F569DE0000-0x000001F569DE1000-memory.dmp

memory/4452-157-0x000000001B9F0000-0x000000001BA00000-memory.dmp

memory/4212-158-0x000001F56ADD0000-0x000001F56AF79000-memory.dmp

memory/4212-162-0x000001F56ADD0000-0x000001F56AF79000-memory.dmp