Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
24/07/2024, 15:08
Behavioral task
behavioral1
Sample
Swift copy.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
General
- Target Swift copy.exe
- Size 598KB
- Sample240724-sh7vmascnm
- SHA256 a073edb1dacc3f6cbb7b416c6196f7d56a8d6d195a337952524e1e8ee5921461
- MD5 aa175e1bf43f1c940ffd2e23f853a070
- SHA1 bf01a6051d30abac10ba726e7ef40a68c17799f6
- SHA512 65e1295e92dc6bd4bbf68c8769312cc024e84b1264e84b44d31cdec28f484dc9ac8026b42b83ff22848724e65ee57b0c9d777bce3896b84c497a668921e2487f
- SSDEEP 12288:mYV6MorX7qzuC3QHO9FQVHPF51jgc/Ppf5/6KLrA5v5Jg:lBXu9HGaVH5hC6k5Bq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
hc58
Decoy
-
reunioncoins.com
-
slot88win.today
-
diamondcarp.com
-
poke138.site
-
cratermaketing.com
-
mutokiva.website
-
thstocks5.online
-
openaquasurge.com
-
prodsdigital.com
-
exileescape.com
-
iqcjuetaudtj.com
-
bwexhaustprofl.com
-
indiglobalconnect.com
-
pushkeyclub.com
-
stephvin.top
-
lifebione.com
-
hannahmegery.com
-
brookchivell.com
-
bioskyline.com
-
nonprofitgrants.online
-
dhfldhs007.com
-
horizonlegalservices.com
-
suhanszki.com
-
royacinnamon.com
-
eastcarolinaapartments.com
-
6jo-aqua.com
-
valemoda.shop
-
nettasfl.com
-
appgo88a.info
-
ajun455678.club
-
homehearthco.com
-
newrica.net
-
b8226.vip
-
theleonlegacy.com
-
smnwa.net
-
brightwayentertainment.net
-
ntitnet.com
-
emfblockage.com
-
latinopridereport.com
-
lensreadylooks.com
-
dijvhy.cfd
-
96722app.com
-
xoflaire.com
-
buiptr.com
-
clepets.com
-
sympathyforthedeli.com
-
zzxxxfxb.xyz
-
artificial-ace.com
-
neonabby.net
-
africanventuresvolunteering.com
-
the-jokers.com
-
opjauz.cfd
-
work-abroad-37879.bond
-
freekmagazine.com
-
work-abroad-27757.bond
-
karaokeboats.com
-
ro-news.site
-
96b52.net
-
texasschooltraining.com
-
coincentral.info
-
spacezaim.site
-
2016euro.net
-
parkxcity.com
-
ylhg779.com
-
abacuzz.dev
Signatures
- Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/1048-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1048-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1048-22-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/672-28-0x0000000000C20000-0x0000000000C4F000-memory.dmp formbook -
resource yara_rule behavioral2/memory/4316-0-0x0000000000320000-0x0000000000477000-memory.dmp upx behavioral2/memory/4316-15-0x0000000000320000-0x0000000000477000-memory.dmp upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4316-15-0x0000000000320000-0x0000000000477000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4316 set thread context of 1048 4316 Swift copy.exe 87 PID 1048 set thread context of 3452 1048 svchost.exe 56 PID 1048 set thread context of 3452 1048 svchost.exe 56 PID 672 set thread context of 3452 672 rundll32.exe 56 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Swift copy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1048 svchost.exe 1048 svchost.exe 1048 svchost.exe 1048 svchost.exe 1048 svchost.exe 1048 svchost.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe 672 rundll32.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4316 Swift copy.exe 1048 svchost.exe 1048 svchost.exe 1048 svchost.exe 1048 svchost.exe 672 rundll32.exe 672 rundll32.exe - Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 1048 svchost.exe Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeDebugPrivilege 672 rundll32.exe Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3452 Explorer.EXE 3452 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3452 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4316 wrote to memory of 1048 4316 Swift copy.exe 87 PID 4316 wrote to memory of 1048 4316 Swift copy.exe 87 PID 4316 wrote to memory of 1048 4316 Swift copy.exe 87 PID 4316 wrote to memory of 1048 4316 Swift copy.exe 87 PID 3452 wrote to memory of 672 3452 Explorer.EXE 94 PID 3452 wrote to memory of 672 3452 Explorer.EXE 94 PID 3452 wrote to memory of 672 3452 Explorer.EXE 94 PID 672 wrote to memory of 4720 672 rundll32.exe 97 PID 672 wrote to memory of 4720 672 rundll32.exe 97 PID 672 wrote to memory of 4720 672 rundll32.exe 97
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4720
-
-