Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 07:19
Static task
static1
Behavioral task
behavioral1
Sample
swift mt 1033.exe
Resource
win7-20240903-en
General
-
Target
swift mt 1033.exe
-
Size
743KB
-
MD5
df300e93be84410e629996a8050e47b2
-
SHA1
1ace59620fa5e6b7717a04ad28620e6a61191c80
-
SHA256
36ac663aee997b4b8da3bd498abcbdb91ca180f7afe402ce8ab166099c098cbf
-
SHA512
435302f901c1068288bf80e5726f3f9d0cbb4bfc6a3b489c7e3260698aa0b3e1707a203d3998b99ea183a21f3a1736eaa422fee358d88eb795647d665fa7b705
-
SSDEEP
12288:w38f2uE1zDf5n7Dm1C8T7bl9JrUKrlR+v+Yyf39fiQyHWsUuAPM5Uf8f2:w3u2uO3B4Ck59ReyfN5kWtuAa4u2
Malware Config
Extracted
formbook
4.1
k49s
ufberyrubiest.shop
tpanekatotosite.top
esona805158762.xyz
earing-tests-15487.bond
rediksitiraitoto.xyz
tore-playstore.online
mpresarialpx38.online
ufxusa.net
reativedesigns.lat
leaning-services-47614.bond
959725nptklnq923.top
treziop.xyz
eubel-bestseller.online
uynewcars.xyz
all-panels-74750.bond
erviceninjas.vip
arectoroffice.xyz
oviesgpt.app
ractors-22059.bond
rakenfitness.info
qatn10.shop
r-dresses-comments-25j.today
ejao.online
iningtruckszone.today
573132.top
cn5u.digital
qatn10.shop
56tm74ah.autos
urkiyekahvecisi.xyz
zincloud.shop
asuraplay77.info
ementia-treatment-40095.bond
lianzatrading.online
otive.app
imba69luckyspin.sbs
ainlamphumidifier.shop
martfile.app
at-casino-sh.buzz
uluthtradingsale.club
my755h.top
eflexive.asia
aboresdemexico.shop
nvestorsinbox.net
tp-turbobet77.live
vcxcvfwe22.shop
nlineredirect.cloud
ueyunlaihong.top
uperfastservic.online
itetalk.net
5940.club
oftware-avast.top
articuli.cloud
atin-dating-52735.bond
taticsitescanary.net
tr77.bet
ift-chairs-17834.bond
viviendapro.online
w165.top
martct.info
odiacdigitaltwin.cloud
ires-66750.bond
xtaapp.fun
63719.vip
in-up-casino-skf2.top
ir-condition-81494.bond
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/208-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/208-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/948-67-0x0000000000CD0000-0x0000000000CFF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2088 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation swift mt 1033.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3800 set thread context of 208 3800 swift mt 1033.exe 89 PID 208 set thread context of 3416 208 swift mt 1033.exe 56 PID 948 set thread context of 3416 948 cmmon32.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmmon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language swift mt 1033.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 208 swift mt 1033.exe 208 swift mt 1033.exe 208 swift mt 1033.exe 208 swift mt 1033.exe 2088 powershell.exe 2088 powershell.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe 948 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 208 swift mt 1033.exe 208 swift mt 1033.exe 208 swift mt 1033.exe 948 cmmon32.exe 948 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 208 swift mt 1033.exe Token: SeDebugPrivilege 2088 powershell.exe Token: SeDebugPrivilege 948 cmmon32.exe Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3800 wrote to memory of 2088 3800 swift mt 1033.exe 87 PID 3800 wrote to memory of 2088 3800 swift mt 1033.exe 87 PID 3800 wrote to memory of 2088 3800 swift mt 1033.exe 87 PID 3800 wrote to memory of 208 3800 swift mt 1033.exe 89 PID 3800 wrote to memory of 208 3800 swift mt 1033.exe 89 PID 3800 wrote to memory of 208 3800 swift mt 1033.exe 89 PID 3800 wrote to memory of 208 3800 swift mt 1033.exe 89 PID 3800 wrote to memory of 208 3800 swift mt 1033.exe 89 PID 3800 wrote to memory of 208 3800 swift mt 1033.exe 89 PID 3416 wrote to memory of 948 3416 Explorer.EXE 90 PID 3416 wrote to memory of 948 3416 Explorer.EXE 90 PID 3416 wrote to memory of 948 3416 Explorer.EXE 90 PID 948 wrote to memory of 1504 948 cmmon32.exe 93 PID 948 wrote to memory of 1504 948 cmmon32.exe 93 PID 948 wrote to memory of 1504 948 cmmon32.exe 93
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\swift mt 1033.exe"C:\Users\Admin\AppData\Local\Temp\swift mt 1033.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\swift mt 1033.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\swift mt 1033.exe"C:\Users\Admin\AppData\Local\Temp\swift mt 1033.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\swift mt 1033.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1504
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82