61894dd6d947ab1237c08e4f020e6462fdc7a96903c7cf27523d4e21304c1612

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SWIFT Transfer (103) 022FT10230717045.exe
Size

752KB
MD5

dd4f4d6dc2c71e6ad5a6b0abf45f8d5e
SHA1

e90bf49def5509412e3c1f10f959c7a8ce121e9a
SHA256

61894dd6d947ab1237c08e4f020e6462fdc7a96903c7cf27523d4e21304c1612
SHA512

aa46b3c2542b2df05bc0a3bf3e15f34c80673090ba97c1b9ab8f86fb8827e3e45ad9adf9dfbefe7aa48a1d35c4dab2ef2c11c3748ec880ec40c2cbbc453e8d39
SSDEEP

12288:Mf+vUyubcW9Roj0fb/WT4UkuZKXP0s95N3KO6GUPy1h8F0XgbeOTRqymNBoIlz1g:MG8VbcW9Roj0fzW/ZacsB16NP8+7UycC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2472	SWIFT Transfer (103) 022FT10230717045.exe
2472	SWIFT Transfer (103) 022FT10230717045.exe
2472	SWIFT Transfer (103) 022FT10230717045.exe
2472	SWIFT Transfer (103) 022FT10230717045.exe
2472	SWIFT Transfer (103) 022FT10230717045.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	SWIFT Transfer (103) 022FT10230717045.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3036	2472	SWIFT Transfer (103) 022FT10230717045.exe	30
PID 2472 wrote to memory of 3036	2472	SWIFT Transfer (103) 022FT10230717045.exe	30
PID 2472 wrote to memory of 3036	2472	SWIFT Transfer (103) 022FT10230717045.exe	30
PID 2472 wrote to memory of 3036	2472	SWIFT Transfer (103) 022FT10230717045.exe	30
PID 2472 wrote to memory of 2328	2472	SWIFT Transfer (103) 022FT10230717045.exe	31
PID 2472 wrote to memory of 2328	2472	SWIFT Transfer (103) 022FT10230717045.exe	31
PID 2472 wrote to memory of 2328	2472	SWIFT Transfer (103) 022FT10230717045.exe	31
PID 2472 wrote to memory of 2328	2472	SWIFT Transfer (103) 022FT10230717045.exe	31
PID 2472 wrote to memory of 2736	2472	SWIFT Transfer (103) 022FT10230717045.exe	32
PID 2472 wrote to memory of 2736	2472	SWIFT Transfer (103) 022FT10230717045.exe	32
PID 2472 wrote to memory of 2736	2472	SWIFT Transfer (103) 022FT10230717045.exe	32
PID 2472 wrote to memory of 2736	2472	SWIFT Transfer (103) 022FT10230717045.exe	32
PID 2472 wrote to memory of 2152	2472	SWIFT Transfer (103) 022FT10230717045.exe	33
PID 2472 wrote to memory of 2152	2472	SWIFT Transfer (103) 022FT10230717045.exe	33
PID 2472 wrote to memory of 2152	2472	SWIFT Transfer (103) 022FT10230717045.exe	33
PID 2472 wrote to memory of 2152	2472	SWIFT Transfer (103) 022FT10230717045.exe	33
PID 2472 wrote to memory of 2424	2472	SWIFT Transfer (103) 022FT10230717045.exe	34
PID 2472 wrote to memory of 2424	2472	SWIFT Transfer (103) 022FT10230717045.exe	34
PID 2472 wrote to memory of 2424	2472	SWIFT Transfer (103) 022FT10230717045.exe	34
PID 2472 wrote to memory of 2424	2472	SWIFT Transfer (103) 022FT10230717045.exe	34

C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe"
  2⤵
  PID:3036
- C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe"
  2⤵
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe"
  2⤵
  PID:2736
- C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe"
  2⤵
  PID:2152
- C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT Transfer (103) 022FT10230717045.exe"
  2⤵
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-53-0x0000000000380000-0x0000000000442000-memory.dmp

Filesize
776KB

Download
memory/2472-54-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2472-55-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/2472-56-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/2472-57-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2472-58-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/2472-59-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download
memory/2472-60-0x0000000005610000-0x000000000567E000-memory.dmp

Filesize
440KB

Download
memory/2472-61-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download