ac0b1f47f36bdbc8974390d8473d74f6e71d5219a338796ed9d0582f8020f8c7

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 09:25

Target
MT103 SWIFT.exe
Size 674KB
Sample240129-ldmkkaeff4
SHA256 ac0b1f47f36bdbc8974390d8473d74f6e71d5219a338796ed9d0582f8020f8c7
MD5 f9bec48a37ed98a974077a4f6afb4516
SHA1 4bd259f7c707aaee689c29ffe7bc38776b275737
SHA512 e77c8de374e88bd5133cd1374f2aed5dee607b9d19612f5d427ac07faa27fc8d41918b5ff9719f5b28404a8c1422855f3ebd4c63b5c67d562ff466ceebe49152
SSDEEP 12288:+yTAoIFFHgeg/cAJt7l2ycDhisk1b893U5ib8vjYM9G4ZRUGY+rddsQuW:+yTAXFxA7Qy6k1g93wd9GkRScHs7W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	MT103 SWIFT.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2708	808	MT103 SWIFT.exe	28
PID 808 wrote to memory of 2708	808	MT103 SWIFT.exe	28
PID 808 wrote to memory of 2708	808	MT103 SWIFT.exe	28
PID 808 wrote to memory of 2708	808	MT103 SWIFT.exe	28
PID 808 wrote to memory of 2588	808	MT103 SWIFT.exe	29
PID 808 wrote to memory of 2588	808	MT103 SWIFT.exe	29
PID 808 wrote to memory of 2588	808	MT103 SWIFT.exe	29
PID 808 wrote to memory of 2588	808	MT103 SWIFT.exe	29
PID 808 wrote to memory of 2296	808	MT103 SWIFT.exe	30
PID 808 wrote to memory of 2296	808	MT103 SWIFT.exe	30
PID 808 wrote to memory of 2296	808	MT103 SWIFT.exe	30
PID 808 wrote to memory of 2296	808	MT103 SWIFT.exe	30
PID 808 wrote to memory of 2888	808	MT103 SWIFT.exe	31
PID 808 wrote to memory of 2888	808	MT103 SWIFT.exe	31
PID 808 wrote to memory of 2888	808	MT103 SWIFT.exe	31
PID 808 wrote to memory of 2888	808	MT103 SWIFT.exe	31
PID 808 wrote to memory of 3052	808	MT103 SWIFT.exe	32
PID 808 wrote to memory of 3052	808	MT103 SWIFT.exe	32
PID 808 wrote to memory of 3052	808	MT103 SWIFT.exe	32
PID 808 wrote to memory of 3052	808	MT103 SWIFT.exe	32

C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe
"C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808
- C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"
  2⤵
  PID:2588
- C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"
  2⤵
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"
  2⤵
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103 SWIFT.exe"
  2⤵
  PID:3052

memory/808-1-0x0000000074260000-0x000000007494E000-memory.dmp

Download

memory/808-0-0x0000000000260000-0x000000000030E000-memory.dmp

Download

memory/808-2-0x0000000004530000-0x0000000004570000-memory.dmp

Download

memory/808-3-0x0000000001DD0000-0x0000000001DEC000-memory.dmp

Download

memory/808-4-0x0000000001DF0000-0x0000000001E04000-memory.dmp

Download

memory/808-5-0x0000000004680000-0x00000000046F6000-memory.dmp

Download

memory/808-6-0x0000000074260000-0x000000007494E000-memory.dmp

Download

memory/808-7-0x0000000004530000-0x0000000004570000-memory.dmp

Download

memory/808-8-0x0000000074260000-0x000000007494E000-memory.dmp

Download