Analysis
-
max time kernel
1798s -
max time network
1802s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30/04/2023, 21:56
Behavioral task
behavioral1
Sample
Swiftfn.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Swiftfn.exe
Resource
win7-20230220-en
General
-
Target
Swiftfn.exe
-
Size
47KB
-
MD5
25d7952b3e8c9f0872ecf4f099cea1a2
-
SHA1
976e307d3fc015452e70acd29ebddef0d8823fac
-
SHA256
7fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
-
SHA512
f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
SSDEEP
768:sJCO9ILoeck+riPUl5kJN/QisVF8YbWgTgDaJivEgK/JDqVc6KN:sJ588kqFzbJga4nkJDqVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
dom45x.duckdns.org:62180
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
resource yara_rule behavioral2/memory/1388-54-0x0000000000100000-0x0000000000112000-memory.dmp asyncrat behavioral2/files/0x00090000000133a3-66.dat asyncrat behavioral2/files/0x00090000000133a3-67.dat asyncrat behavioral2/memory/980-68-0x0000000000EC0000-0x0000000000ED2000-memory.dmp asyncrat behavioral2/memory/980-69-0x000000001B1F0000-0x000000001B270000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 980 Runtime Broker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1164 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1924 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1388 Swiftfn.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1388 Swiftfn.exe Token: SeDebugPrivilege 980 Runtime Broker.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1388 wrote to memory of 560 1388 Swiftfn.exe 27 PID 1388 wrote to memory of 560 1388 Swiftfn.exe 27 PID 1388 wrote to memory of 560 1388 Swiftfn.exe 27 PID 560 wrote to memory of 1164 560 cmd.exe 29 PID 560 wrote to memory of 1164 560 cmd.exe 29 PID 560 wrote to memory of 1164 560 cmd.exe 29 PID 1388 wrote to memory of 628 1388 Swiftfn.exe 30 PID 1388 wrote to memory of 628 1388 Swiftfn.exe 30 PID 1388 wrote to memory of 628 1388 Swiftfn.exe 30 PID 628 wrote to memory of 1924 628 cmd.exe 32 PID 628 wrote to memory of 1924 628 cmd.exe 32 PID 628 wrote to memory of 1924 628 cmd.exe 32 PID 628 wrote to memory of 980 628 cmd.exe 33 PID 628 wrote to memory of 980 628 cmd.exe 33 PID 628 wrote to memory of 980 628 cmd.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"C:\Users\Admin\AppData\Local\Temp\Swiftfn.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Runtime Broker" /tr '"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"'3⤵
- Creates scheduled task(s)
PID:1164
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3554.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1924
-
-
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
158B
MD5624ce4441d0ca2b99daec192a7a047d8
SHA142a0eaa983ca28d5a49372e455ad8808176d7a6d
SHA256fce80830eba5ac4c20cfe6284ffd9a7842b23a0d4f807e5fe03dde09248dd78b
SHA5124c150e28f04d5e32b7d586f974027d5e37a7c4f5524e2b7e8386e9cc4699e5354849d005d796d3fc40ee21978ba1b429e4f3b5b41c8dcb585b8e0814e09f5287
-
Filesize
158B
MD5624ce4441d0ca2b99daec192a7a047d8
SHA142a0eaa983ca28d5a49372e455ad8808176d7a6d
SHA256fce80830eba5ac4c20cfe6284ffd9a7842b23a0d4f807e5fe03dde09248dd78b
SHA5124c150e28f04d5e32b7d586f974027d5e37a7c4f5524e2b7e8386e9cc4699e5354849d005d796d3fc40ee21978ba1b429e4f3b5b41c8dcb585b8e0814e09f5287
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb
-
Filesize
47KB
MD525d7952b3e8c9f0872ecf4f099cea1a2
SHA1976e307d3fc015452e70acd29ebddef0d8823fac
SHA2567fb468df5b46d1eb0f26e737c515a5a10794b84c9193628efb71c9c32fe8edc1
SHA512f81102833efd450be231d238f3065cf3d5cb9ae6c60f0a4e6b057ffd4c78a2767b0fd8aff54e0bb08ebdf5b5da293f622e68c4874776f0fa25adfd639ca4f3eb