swapper | a74406a738252ac59d265e2a5f1e226afb588025c66f2d56028555f599b615fd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/04/2026, 08:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a74406a738252ac59d265e2a5f1e226afb588025c66f2d56028555f599b615fd.exe
Size 46KB
Sample260413-jwt19aas7t
SHA256 a74406a738252ac59d265e2a5f1e226afb588025c66f2d56028555f599b615fd
MD5 d63a9fcea694c8068739540298a10800
SHA1 50bc34c981d4306c4eb241fdd2981c9fcda27844
SHA512 d328719f36bb6f2274fe9f4ef1ecc028552efb5bb7167ec4b3a6c19aa8dcc4e928daebf7da27ae61cca524bbf7c83c46d1c674f7f77ccd27f356219418eef7f8
SSDEEP 768:ntJ1UdJwJ0nvSxvdLEncYPG8d4plleUHNzp4zpPez1zzA3ydV+fH:oJwJ0nvSxvdLEybQUHhp49+K3ydVE
TLSH
T17E23C50873FC4538F2FF9B79857621184BB6B9475831CE0D0DEA698E0A67B41CA51F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery swapper stealer

Malware Config

Signatures

Detects Swapper 1 IoCs

resource	yara_rule
behavioral2/memory/3240-0-0x00000000003B0000-0x00000000003C2000-memory.dmp	family_swapper

Swapper
Swapper a Windows stealer written in C#.
stealer swapper
Swapper family
swapper

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3168	3240	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a74406a738252ac59d265e2a5f1e226afb588025c66f2d56028555f599b615fd.exe

C:\Users\Admin\AppData\Local\Temp\a74406a738252ac59d265e2a5f1e226afb588025c66f2d56028555f599b615fd.exe
"C:\Users\Admin\AppData\Local\Temp\a74406a738252ac59d265e2a5f1e226afb588025c66f2d56028555f599b615fd.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 896
  2⤵
  - Program crash
  PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3240 -ip 3240
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3240-0-0x00000000003B0000-0x00000000003C2000-memory.dmp

Download