Analysis
-
max time kernel
57s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 20:33
Behavioral task
behavioral1
Sample
Latern Swapper V3.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Latern Swapper V3.exe
Resource
win10v2004-20241007-en
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral3
Sample
S���諭.pyc
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
S���諭.pyc
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Latern Swapper V3.exe
-
Size
6.9MB
-
MD5
ce2e1258b45ecba7fb633e66e27cd64a
-
SHA1
c9b8d5d577237aa12e3ab0127488fd383abbed3e
-
SHA256
e93bf408e5e36c7539ccc5a9be713ce29e482f0a82856aa651e85d05ba6652c9
-
SHA512
df22af49327df2314dc424e2406cfb797b125b1c8d2719825cd97c1ed755667f64c604c3a706eef44a58987a3de0a1b0b9be10d070f4f67f3b0c828f93978a1e
-
SSDEEP
98304:giDjWM8JEE1FpamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIFWG:gi0SeNTfm/pf+xk4dWRpmrbW3jmrP
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2968 Latern Swapper V3.exe -
resource yara_rule behavioral1/files/0x000500000001960c-21.dat upx behavioral1/memory/2968-23-0x000007FEF5E70000-0x000007FEF6458000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3028 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3028 taskmgr.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 2968 Latern Swapper V3.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe -
Suspicious use of SendNotifyMessage 52 IoCs
pid Process 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2968 2620 Latern Swapper V3.exe 30 PID 2620 wrote to memory of 2968 2620 Latern Swapper V3.exe 30 PID 2620 wrote to memory of 2968 2620 Latern Swapper V3.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Latern Swapper V3.exe"C:\Users\Admin\AppData\Local\Temp\Latern Swapper V3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\Latern Swapper V3.exe"C:\Users\Admin\AppData\Local\Temp\Latern Swapper V3.exe"2⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2968
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3028
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31