b089fa2bc45c847783b8eb957d9d1023f707a96073f2657d6a838eaf5619949b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 10:34

Target
TT-SWIFT-ERROR.exe
Size 618KB
Sample240327-ml33ysdc8v
SHA256 b089fa2bc45c847783b8eb957d9d1023f707a96073f2657d6a838eaf5619949b
MD5 adc47f20cba61f1a2f8171791a455d09
SHA1 62508fbdde7bfb78e927495bb96d78ceb832a1ae
SHA512 49ee25101729fe1d351d6b96861be96c0fe273ecc3c3378fc42848ef1d46f6e6128982b695de7a8639b1529791c541f4ad2077c93c11155dc0d5ebbe63e8414c
SSDEEP 12288:4JMa5WyV/cXi7Cc8oZJfLyXrCt9vFjMRL9fPzDYUE8P8ITjEQ:4OS/kJoMIFCRhfgq8+j7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	TT-SWIFT-ERROR.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3020	2868	TT-SWIFT-ERROR.exe	28
PID 2868 wrote to memory of 3020	2868	TT-SWIFT-ERROR.exe	28
PID 2868 wrote to memory of 3020	2868	TT-SWIFT-ERROR.exe	28
PID 2868 wrote to memory of 3020	2868	TT-SWIFT-ERROR.exe	28
PID 2868 wrote to memory of 2548	2868	TT-SWIFT-ERROR.exe	29
PID 2868 wrote to memory of 2548	2868	TT-SWIFT-ERROR.exe	29
PID 2868 wrote to memory of 2548	2868	TT-SWIFT-ERROR.exe	29
PID 2868 wrote to memory of 2548	2868	TT-SWIFT-ERROR.exe	29
PID 2868 wrote to memory of 2536	2868	TT-SWIFT-ERROR.exe	30
PID 2868 wrote to memory of 2536	2868	TT-SWIFT-ERROR.exe	30
PID 2868 wrote to memory of 2536	2868	TT-SWIFT-ERROR.exe	30
PID 2868 wrote to memory of 2536	2868	TT-SWIFT-ERROR.exe	30
PID 2868 wrote to memory of 2556	2868	TT-SWIFT-ERROR.exe	31
PID 2868 wrote to memory of 2556	2868	TT-SWIFT-ERROR.exe	31
PID 2868 wrote to memory of 2556	2868	TT-SWIFT-ERROR.exe	31
PID 2868 wrote to memory of 2556	2868	TT-SWIFT-ERROR.exe	31
PID 2868 wrote to memory of 2632	2868	TT-SWIFT-ERROR.exe	32
PID 2868 wrote to memory of 2632	2868	TT-SWIFT-ERROR.exe	32
PID 2868 wrote to memory of 2632	2868	TT-SWIFT-ERROR.exe	32
PID 2868 wrote to memory of 2632	2868	TT-SWIFT-ERROR.exe	32

C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe
"C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe
  "C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"
  2⤵
  PID:3020
- C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe
  "C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe
  "C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe
  "C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"
  2⤵
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe
  "C:\Users\Admin\AppData\Local\Temp\TT-SWIFT-ERROR.exe"
  2⤵
  PID:2632

memory/2868-1-0x0000000074860000-0x0000000074F4E000-memory.dmp

Download

memory/2868-0-0x0000000000370000-0x0000000000410000-memory.dmp

Download

memory/2868-2-0x0000000004EE0000-0x0000000004F20000-memory.dmp

Download

memory/2868-3-0x0000000000440000-0x0000000000452000-memory.dmp

Download

memory/2868-4-0x0000000000460000-0x000000000046C000-memory.dmp

Download

memory/2868-5-0x00000000049B0000-0x0000000004A34000-memory.dmp

Download

memory/2868-6-0x0000000074860000-0x0000000074F4E000-memory.dmp

Download