Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 13:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
swift copy.exe
Resource
win7-20240611-en
windows7-x64
9 signatures
150 seconds
General
- Target swift copy.exe
- Size 1.1MB
- Sample240613-q2dpsavhpj
- SHA256 491951b8a84f49dd5a5c0bdea5370223a8ac834d47d53a526f628733325dd5c9
- MD5 e9c6a41856090c8eb226b8342166c58a
- SHA1 217fdcfe9df26442e307ba60ebef9255633f13b8
- SHA512 d2a99a05836dd861badc291952db513bcdfb0b5b7f18e733c9fff01ed85559391d1f1dac3ef1ea21ba870fc827ad95db25be98f58132fa59bbc3fdaf2e765ebe
- SSDEEP 24576:8AHnh+eWsN3skA4RV1Hom2KXMmHa46VQzGOd23X5:bh+ZkldoPK8Ya46qzLdE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
as02
Decoy
-
qwin777.com
-
robinhoods.live
-
h3jh-dal.pics
-
braindeadcopywriting.com
-
kktcbet1000.com
-
mpo0463.cfd
-
raboteshoes.com
-
ab1718.com
-
lowcrusiers.com
-
gregcopelandmusic.com
-
dkfndch.store
-
firstclassuni.com
-
00ewu1ub.com
-
shunweichemical.com
-
sugarits.com
-
marqify.com
-
mistmajik.com
-
trezip.online
-
tinytables.xyz
-
suestergocoaching.com
-
dominoad.com
-
specials.website
-
thatpilatesgirl.com
-
vrexpressok.com
-
sdegtho.com
-
svhomesinspections.com
-
rumbol88.com
-
dzplricfpf.com
-
fastcoolify.com
-
bloominginwholeness.com
-
12ser3.com
-
curtsreno.com
-
defx.ventures
-
dev-patel.xyz
-
ltyidc.com
-
wheiunudweowuqiwuebfyewui3.com
-
039c5m2ciwt99.top
-
pmpm.xyz
-
akabuka.net
-
parkerslandscapingllc.com
-
hamcast.com
-
jiangcapable.site
-
sassysensoryclips.com
-
arsalan.shop
-
thecryptocaviar.com
-
ofbsconsulting.com
-
j8j3e.cfd
-
cinexgltd.com
-
justcallnadia.com
-
qcyiran.com
-
uniseekglobal.com
-
milieunightclub.com
-
sisasimoslot.com
-
svizzblem.net
-
20644.asia
-
shroomberparty.com
-
contractcrafters.net
-
selectstylehome.shop
-
blackhillspr.com
-
topsolutionquality.online
-
diywithbje.com
-
simplywellcoach.com
-
popothebear.site
-
entendiendomedicare.com
-
sopaindam.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1072-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1072-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3756-19-0x0000000000800000-0x000000000082F000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1928 set thread context of 1072 1928 swift copy.exe 85 PID 1072 set thread context of 3556 1072 svchost.exe 56 PID 3756 set thread context of 3556 3756 msdt.exe 56 - Program crash 1 IoCs
pid pid_target Process procid_target 1904 1928 WerFault.exe 81 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1072 svchost.exe 1072 svchost.exe 1072 svchost.exe 1072 svchost.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe 3756 msdt.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1928 swift copy.exe 1072 svchost.exe 1072 svchost.exe 1072 svchost.exe 3756 msdt.exe 3756 msdt.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1072 svchost.exe Token: SeShutdownPrivilege 3556 Explorer.EXE Token: SeCreatePagefilePrivilege 3556 Explorer.EXE Token: SeShutdownPrivilege 3556 Explorer.EXE Token: SeCreatePagefilePrivilege 3556 Explorer.EXE Token: SeDebugPrivilege 3756 msdt.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1928 swift copy.exe 1928 swift copy.exe 3556 Explorer.EXE 3556 Explorer.EXE 3556 Explorer.EXE - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1928 swift copy.exe 1928 swift copy.exe 3556 Explorer.EXE 3556 Explorer.EXE 3556 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3556 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1072 1928 swift copy.exe 85 PID 1928 wrote to memory of 1072 1928 swift copy.exe 85 PID 1928 wrote to memory of 1072 1928 swift copy.exe 85 PID 1928 wrote to memory of 1072 1928 swift copy.exe 85 PID 3556 wrote to memory of 3756 3556 Explorer.EXE 89 PID 3556 wrote to memory of 3756 3556 Explorer.EXE 89 PID 3556 wrote to memory of 3756 3556 Explorer.EXE 89 PID 3756 wrote to memory of 2312 3756 msdt.exe 90 PID 3756 wrote to memory of 2312 3756 msdt.exe 90 PID 3756 wrote to memory of 2312 3756 msdt.exe 90
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\swift copy.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 6963⤵
- Program crash
PID:1904
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:2312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1928 -ip 19281⤵PID:4204