Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 07:00
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-20240221-en
General
-
Target
Swift Copy.exe
-
Size
49KB
-
MD5
fadef7ce43e9627a752d03a41e71ee41
-
SHA1
f8a9907fdb73ca4b162b20a79d9384ab5277af31
-
SHA256
80762425adc5f24b5c7be359dd4cb7c1c657bb21f0304dcb89eb6bd6d8d8e0da
-
SHA512
764ddce479431043510647f95fb376be3b62bc7e6283173c9d7849130335a8daa2aad2b86e8a7693cd5c92c1b94e809cf1a0ec1ecbb2fb6c196d1764a0a9a081
-
SSDEEP
768:P1YSqVwQ8rD6pSg12mkQu3MyoELiym7/FDFTNxIrgBjv5VQ6:PyeQkDxtcyJm7tk0jv5VJ
Malware Config
Extracted
formbook
4.1
sr62
pizzaperol.com
brooklynlearningstudio.com
legendlearningacghy.net
xtlg3i19o7czkv4.buzz
outdoorsproducts.xyz
nissanthanhhoa.com
mtviewproservices.com
tichris.com
monopolygo.llc
engagemaxmail.com
supremeinsure.com
2018b7.com
tedxkarunyauniversity.com
vaishnaviyoga.in
goddessoffetish.com
dazewu.com
844385.autos
caluxio.com
restaurantlataberna.com
charlieahunter.com
odvip587.com
anashamilton.com
jeep119.com
writebetter.io
npg.world
ashlynbellamy.com
matrixmech.com
spotaac.com
salazar-womens-apparel.com
soothe.fm
odty819.net
mega278.com
constructionsbretonetfils.com
labherbajar.com
fndegkgnqweitltjkoos.com
cb284.cc
salesbiome.bio
catpixel.art
vitalsdentalclinic.com
roofing-services-19534.bond
mojomanna.com
singhaseni.net
dolby-atmos-mixing.net
frontandboundary.co
silvercreeksocial.com
campinggoals.com
assalambahji.com
jtcloud.xyz
diancaigui.info
dongless.com
imnaheal.online
serviciosferiales.online
sagitar.cc
renxren.com
honeybeedentalhygiene.com
plcu5c.vip
edoybphu.shop
momvlogs.com
globaltd4613.xyz
internet-providers-58517.bond
emanews.info
harrisonm-fitness.com
yufde.xyz
thecarocellmusic.com
vhimvd-shop.club
Signatures
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral2/memory/4592-3-0x0000000008B40000-0x0000000008D7E000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-9-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-13-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-11-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-27-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-33-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-43-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-65-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-67-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-69-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-63-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-61-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-59-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-57-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-55-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-53-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-51-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-49-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-47-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-45-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-41-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-39-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-37-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-35-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-31-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-29-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-25-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-23-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-21-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-19-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-17-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-15-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-7-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 behavioral2/memory/4592-6-0x0000000008B40000-0x0000000008D78000-memory.dmp family_zgrat_v1 -
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/3560-4894-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3560-4898-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4592 set thread context of 3560 4592 Swift Copy.exe 98 PID 3560 set thread context of 3492 3560 Swift Copy.exe 56 PID 404 set thread context of 3492 404 msdt.exe 56 -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3560 Swift Copy.exe 3560 Swift Copy.exe 3560 Swift Copy.exe 3560 Swift Copy.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe 404 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3560 Swift Copy.exe 3560 Swift Copy.exe 3560 Swift Copy.exe 404 msdt.exe 404 msdt.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4592 Swift Copy.exe Token: SeDebugPrivilege 4592 Swift Copy.exe Token: SeDebugPrivilege 3560 Swift Copy.exe Token: SeDebugPrivilege 404 msdt.exe Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3492 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4592 wrote to memory of 3560 4592 Swift Copy.exe 98 PID 4592 wrote to memory of 3560 4592 Swift Copy.exe 98 PID 4592 wrote to memory of 3560 4592 Swift Copy.exe 98 PID 4592 wrote to memory of 3560 4592 Swift Copy.exe 98 PID 4592 wrote to memory of 3560 4592 Swift Copy.exe 98 PID 4592 wrote to memory of 3560 4592 Swift Copy.exe 98 PID 3492 wrote to memory of 404 3492 Explorer.EXE 99 PID 3492 wrote to memory of 404 3492 Explorer.EXE 99 PID 3492 wrote to memory of 404 3492 Explorer.EXE 99 PID 404 wrote to memory of 4896 404 msdt.exe 100 PID 404 wrote to memory of 4896 404 msdt.exe 100 PID 404 wrote to memory of 4896 404 msdt.exe 100
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"3⤵PID:4896
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:81⤵PID:4544