Analysis
-
max time kernel
62s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 10:43
Static task
static1
Behavioral task
behavioral1
Sample
HEpu SWIFT.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
HEpu SWIFT.exe
Resource
win10v2004-20240419-en
General
-
Target
HEpu SWIFT.exe
-
Size
825KB
-
MD5
e6a12fc71511e3aa16c523bc6f1c6beb
-
SHA1
e6893d94c0b4e898b9d491610ea679112942c2c5
-
SHA256
7c734ef576fc3a9ef020c19f95dbb7f14225393ee9a0e0054bb10de5ec7ec2f0
-
SHA512
63e1cdd4bce8b782acdefded193bb8cca242bbc1d524e83fb6d5ce1c8760420c3f7eccef25b23c9a238688ae9b5206b6998da8a980113cdb005cbf24d621f55c
-
SSDEEP
12288:NrqnHvjNIrpf9rN/mc/C6AgGXsEdBgEYviJqienJYUTQdXsw6E5sAQ3cwFqZu6Qr:NePjKr5BNDnACKJJIYsAQ3chw8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.jspkragujevac.rs - Port:
587 - Username:
[email protected] - Password:
LA5dv##fbU%5 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HEpu SWIFT.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation HEpu SWIFT.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HEpu SWIFT.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NcnBt = "C:\\Users\\Admin\\AppData\\Roaming\\NcnBt\\NcnBt.exe" HEpu SWIFT.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HEpu SWIFT.exedescription pid process target process PID 3760 set thread context of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeHEpu SWIFT.exepid process 4100 powershell.exe 1844 HEpu SWIFT.exe 1844 HEpu SWIFT.exe 4100 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeHEpu SWIFT.exedescription pid process Token: SeDebugPrivilege 4100 powershell.exe Token: SeDebugPrivilege 1844 HEpu SWIFT.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
HEpu SWIFT.exedescription pid process target process PID 3760 wrote to memory of 4100 3760 HEpu SWIFT.exe powershell.exe PID 3760 wrote to memory of 4100 3760 HEpu SWIFT.exe powershell.exe PID 3760 wrote to memory of 4100 3760 HEpu SWIFT.exe powershell.exe PID 3760 wrote to memory of 464 3760 HEpu SWIFT.exe schtasks.exe PID 3760 wrote to memory of 464 3760 HEpu SWIFT.exe schtasks.exe PID 3760 wrote to memory of 464 3760 HEpu SWIFT.exe schtasks.exe PID 3760 wrote to memory of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe PID 3760 wrote to memory of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe PID 3760 wrote to memory of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe PID 3760 wrote to memory of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe PID 3760 wrote to memory of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe PID 3760 wrote to memory of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe PID 3760 wrote to memory of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe PID 3760 wrote to memory of 1844 3760 HEpu SWIFT.exe HEpu SWIFT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEpu SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\HEpu SWIFT.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\brirwbdh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\brirwbdh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6EB8.tmp"2⤵
- Creates scheduled task(s)
PID:464 -
C:\Users\Admin\AppData\Local\Temp\HEpu SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\HEpu SWIFT.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HEpu SWIFT.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dphvzw43.54j.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp6EB8.tmpFilesize
1KB
MD52c1a5b5ec6fc5221b45f9a2429c5b061
SHA1715ddcc3f39b66bb1710d0d1d364a6aec0a678e4
SHA25643ef692860957ede9b1d51383822b915195e8905980ce606fdb8f48eabd03cb5
SHA512a5dd48d68d71902a0989ad9b1fac9d760cde10f2861d3b80baf6d92d5fe030ac6ce8763649442fd5e8d35a6d43f253cc1734e303250fb173c44eef61438ae8bb
-
memory/1844-67-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/1844-28-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/1844-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1844-66-0x0000000006B10000-0x0000000006B60000-memory.dmpFilesize
320KB
-
memory/3760-4-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3760-8-0x0000000008B30000-0x0000000008BB4000-memory.dmpFilesize
528KB
-
memory/3760-9-0x00000000075D0000-0x000000000766C000-memory.dmpFilesize
624KB
-
memory/3760-0-0x0000000000180000-0x0000000000254000-memory.dmpFilesize
848KB
-
memory/3760-7-0x0000000005210000-0x0000000005224000-memory.dmpFilesize
80KB
-
memory/3760-6-0x0000000005F50000-0x0000000005F70000-memory.dmpFilesize
128KB
-
memory/3760-5-0x0000000004C60000-0x0000000004C6A000-memory.dmpFilesize
40KB
-
memory/3760-3-0x0000000004C80000-0x0000000004D12000-memory.dmpFilesize
584KB
-
memory/3760-2-0x0000000005230000-0x00000000057D4000-memory.dmpFilesize
5.6MB
-
memory/3760-27-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/3760-1-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/4100-14-0x0000000002E30000-0x0000000002E66000-memory.dmpFilesize
216KB
-
memory/4100-53-0x00000000080B0000-0x000000000872A000-memory.dmpFilesize
6.5MB
-
memory/4100-22-0x00000000059B0000-0x0000000005A16000-memory.dmpFilesize
408KB
-
memory/4100-20-0x0000000005690000-0x00000000056B2000-memory.dmpFilesize
136KB
-
memory/4100-18-0x0000000005B00000-0x0000000006128000-memory.dmpFilesize
6.2MB
-
memory/4100-26-0x00000000061A0000-0x00000000064F4000-memory.dmpFilesize
3.3MB
-
memory/4100-17-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/4100-38-0x0000000006740000-0x000000000675E000-memory.dmpFilesize
120KB
-
memory/4100-39-0x0000000006760000-0x00000000067AC000-memory.dmpFilesize
304KB
-
memory/4100-40-0x0000000006D00000-0x0000000006D32000-memory.dmpFilesize
200KB
-
memory/4100-41-0x0000000070910000-0x000000007095C000-memory.dmpFilesize
304KB
-
memory/4100-51-0x0000000006CE0000-0x0000000006CFE000-memory.dmpFilesize
120KB
-
memory/4100-52-0x0000000007720000-0x00000000077C3000-memory.dmpFilesize
652KB
-
memory/4100-23-0x0000000006130000-0x0000000006196000-memory.dmpFilesize
408KB
-
memory/4100-54-0x0000000007A60000-0x0000000007A7A000-memory.dmpFilesize
104KB
-
memory/4100-55-0x0000000007AD0000-0x0000000007ADA000-memory.dmpFilesize
40KB
-
memory/4100-56-0x0000000007CE0000-0x0000000007D76000-memory.dmpFilesize
600KB
-
memory/4100-57-0x0000000007C60000-0x0000000007C71000-memory.dmpFilesize
68KB
-
memory/4100-58-0x0000000007C90000-0x0000000007C9E000-memory.dmpFilesize
56KB
-
memory/4100-59-0x0000000007CA0000-0x0000000007CB4000-memory.dmpFilesize
80KB
-
memory/4100-60-0x0000000007DA0000-0x0000000007DBA000-memory.dmpFilesize
104KB
-
memory/4100-61-0x0000000007D80000-0x0000000007D88000-memory.dmpFilesize
32KB
-
memory/4100-64-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB
-
memory/4100-16-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/4100-15-0x0000000074880000-0x0000000075030000-memory.dmpFilesize
7.7MB