General
-
Target
AccessSwift.exe
-
Size
13.3MB
-
Sample
250119-m77y2avqhq
-
MD5
427e4b6721a6975a2d1b14d602ab4245
-
SHA1
bf6830970ac7104b44f015c6cd551451aff7c058
-
SHA256
9503a906f7595d8fe6a447f9b7323d1c7d07312aa2a37b922b7458b375690381
-
SHA512
3afb21f343b91a615795b5a53c4d4ae68b179a5f5390412e074c6166bb1ef1435539094919a35ef8cfaa1cb2dbe5f91fbef860ffb83fd1b4924cca76e39618d1
-
SSDEEP
196608:D4o0I2eNTfm/pf+xk4dWRimrbW3jmyAHJv8S8DdQmRm8Qnf2ODjMnGydS8wOP:jy/pWu4kRimrbmyblAdQdF3MnG38wOP
Behavioral task
behavioral1
Sample
AccessSwift.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AccessSwift.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
AccessSwift.exe
-
Size
13.3MB
-
MD5
427e4b6721a6975a2d1b14d602ab4245
-
SHA1
bf6830970ac7104b44f015c6cd551451aff7c058
-
SHA256
9503a906f7595d8fe6a447f9b7323d1c7d07312aa2a37b922b7458b375690381
-
SHA512
3afb21f343b91a615795b5a53c4d4ae68b179a5f5390412e074c6166bb1ef1435539094919a35ef8cfaa1cb2dbe5f91fbef860ffb83fd1b4924cca76e39618d1
-
SSDEEP
196608:D4o0I2eNTfm/pf+xk4dWRimrbW3jmyAHJv8S8DdQmRm8Qnf2ODjMnGydS8wOP:jy/pWu4kRimrbmyblAdQdF3MnG38wOP
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1