e54c15ea5da3277ce9ce7c4242db9b7e1248acc7fed2b84be6dd4d9abaa2e92d | Triage

Sharing

General

Target

Swift Copy.exe
Size

626KB
Sample

231003-hkmblaaf72
MD5

ec980b2eaacb57ec35da3995f975d283
SHA1

76c281f8deffa691c07d822554d8dcf98fe59c3a
SHA256

e54c15ea5da3277ce9ce7c4242db9b7e1248acc7fed2b84be6dd4d9abaa2e92d
SHA512

585c5576ea7c14029eaa43d2576c4c2b267c09bc34c283a5c52bc28628503db34594171da27c2beaa26ab0148fa9048d662656cfeb39d1b7fb315d9cbf5b572b
SSDEEP

12288:oGaG5jfdincG9udbntW3khdcm9SrwAlp0iIjavCyXTSJ3ykVZ/65LqRVNumB0:Br55Cudb03khdch5ImTTUykX/qLqRuy

Score

7^/10

Malware Config

Targets

- Target
  
  Swift Copy.exe
- Size
  
  626KB
- MD5
  
  ec980b2eaacb57ec35da3995f975d283
- SHA1
  
  76c281f8deffa691c07d822554d8dcf98fe59c3a
- SHA256
  
  e54c15ea5da3277ce9ce7c4242db9b7e1248acc7fed2b84be6dd4d9abaa2e92d
- SHA512
  
  585c5576ea7c14029eaa43d2576c4c2b267c09bc34c283a5c52bc28628503db34594171da27c2beaa26ab0148fa9048d662656cfeb39d1b7fb315d9cbf5b572b
- SSDEEP
  
  12288:oGaG5jfdincG9udbntW3khdcm9SrwAlp0iIjavCyXTSJ3ykVZ/65LqRVNumB0:Br55Cudb03khdch5ImTTUykX/qLqRuy
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2