Analysis
-
max time kernel
1802s -
max time network
1808s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
30/04/2023, 21:56
Behavioral task
behavioral1
Sample
Swiftfn.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Swiftfn.exe
Resource
win7-20230220-en
General
-
Target
Swiftfn.exe
-
Size
47KB
-
MD5
25d7952b3e8c9f0872ecf4f099cea1a2
-
SHA1
976e307d3fc015452e70acd29ebddef0d8823fac
-
SHA256
7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
-
SHA512
f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
SSDEEP
768:sJCO9ILoeck+riPUl5kJN/QisVF8YbWgTgDaJivEgK/JDqVc6KN:sJ588kqFzbJga4nkJDqVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
dom45x.duckdns.org:62180
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
resource yara_rule behavioral1/memory/2488-121-0x00000000000B0000-0x00000000000C2000-memory.dmp asyncrat behavioral1/files/0x000500000001a2b4-129.dat asyncrat behavioral1/files/0x000500000001a2b4-130.dat asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2900 Runtime Broker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3952 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4056 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe 2488 Swiftfn.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2488 Swiftfn.exe Token: SeDebugPrivilege 2900 Runtime Broker.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2992 2488 Swiftfn.exe 69 PID 2488 wrote to memory of 2992 2488 Swiftfn.exe 69 PID 2488 wrote to memory of 3508 2488 Swiftfn.exe 66 PID 2488 wrote to memory of 3508 2488 Swiftfn.exe 66 PID 2992 wrote to memory of 3952 2992 cmd.exe 71 PID 2992 wrote to memory of 3952 2992 cmd.exe 71 PID 3508 wrote to memory of 4056 3508 cmd.exe 70 PID 3508 wrote to memory of 4056 3508 cmd.exe 70 PID 3508 wrote to memory of 2900 3508 cmd.exe 72 PID 3508 wrote to memory of 2900 3508 cmd.exe 72 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCC0F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4056
-
-
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"'3⤵
- Creates scheduled task(s)
PID:3952
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD58e322549befedb27d4334ad06fa57de7
SHA1b5b5ba07e644a61180b845fad3dfd1cb4c689e92
SHA256b8fa7516cec8a3a7a022663e8b67e86fa785a38abb65c3fcd60a77777783cd51
SHA512839d4c7727c9558fdd3be074637432602f252af7518ce5b8a396aafc0be52bc34c88f35e4b3fea68f94e9dc7d347f068acc7411ba05360dd679445336ea471bf
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb