36bd2802a452a2bee1659648b0a4b1de0cde1ebac09d0d5ebe0e2c1189483432

Analysis

max time kernel
141s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/05/2023, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift Copy.exe
Size 885KB
Sample230522-k96smsfd24
SHA256 36bd2802a452a2bee1659648b0a4b1de0cde1ebac09d0d5ebe0e2c1189483432
MD5 56c549f58a5599f70ff46119d85e4294
SHA1 60af63e3de940c609929f0101867dd3b2bb2c24c
SHA512 23afe59ab921c040aa44412f978c6c9a7c53c9203b767712375d07dbd2189cc9f9051d9eb16fb9510fa0b19439b29c59ab7b4a14a2f4f2fcc895541e014e4137
SSDEEP 24576:W8ZUsk4Zy5lZoZgY8IrRmV9lKyRyBD2qm82YwP0:JZUwklWZghaMTl98d27YwP0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 580	2036	Swift Copy.exe	27

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2036	Swift Copy.exe
2036	Swift Copy.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe
580	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	Swift Copy.exe
Token: SeDebugPrivilege	580	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27
PID 2036 wrote to memory of 580	2036	Swift Copy.exe	27

C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/580-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/580-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/580-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/580-64-0x0000000000A20000-0x0000000000D23000-memory.dmp

Download

memory/580-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2036-54-0x00000000011D0000-0x00000000012B4000-memory.dmp

Download

memory/2036-55-0x0000000001090000-0x00000000010D0000-memory.dmp

Download

memory/2036-56-0x0000000000550000-0x0000000000560000-memory.dmp

Download

memory/2036-57-0x00000000008A0000-0x00000000008AA000-memory.dmp

Download

memory/2036-58-0x0000000007F80000-0x0000000008022000-memory.dmp

Download

memory/2036-59-0x000000000A6F0000-0x000000000A75A000-memory.dmp

Download