swift_loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
swift_loader.exe
Size 13.6MB
Sample260802-wsy71sdg86
SHA256 45534e56546e2fb840e57f243d75157477f733ce0787527c0d3901b94f7c2ae5
MD5 0c3177dbe3c9c731aba359ea534ff721
SHA1 95a1c57528f3263ff11b02584771d13b33f02557
SHA512 ea86e77c8aaf4543a74b08f68000b24ae02fffcda2441cdf679b97aac08061888ea02d88bc903a1364938873675a13d25d9d984d3995b416c92013f0d9f54c77
SSDEEP 393216:yUJTPDqw1SC3iewg5X7Qs69zLUOeHLcgbQa6:twWQsLDHLcg8
TLSH
T19BE6C052B7E854A9D036E0388A976A0BF2727415033086EB3BD40A2D5FB77E05B77F52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
swift_loader.exe

File Explorer

swift_loader.exe

.exe 13.6MB

swift_loader.exe

IMPHASH 795b589a65c0d80928e0b79a13c31a5a
SHA256 45534e56546e2fb840e57f243d75157477f733ce0787527c0d3901b94f7c2ae5
MD5 0c3177dbe3c9c731aba359ea534ff721
SHA1 95a1c57528f3263ff11b02584771d13b33f02557
SHA512 ea86e77c8aaf4543a74b08f68000b24ae02fffcda2441cdf679b97aac08061888ea02d88bc903a1364938873675a13d25d9d984d3995b416c92013f0d9f54c77
SSDEEP 393216:yUJTPDqw1SC3iewg5X7Qs69zLUOeHLcgbQa6:twWQsLDHLcg8
TLSH
T19BE6C052B7E854A9D036E0388A976A0BF2727415033086EB3BD40A2D5FB77E05B77F52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1224976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ar0wz\Desktop\swift loader new\swift loader new\x64\Release\swift_loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

advapi32

IsValidSid CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl ConvertSidToStringSidA RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid CryptAcquireContextW

shell32

ShellExecuteW ShellExecuteA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

kernel32

FindClose GetFileAttributesA OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte VerSetConditionMask FreeLibrary QueryPerformanceCounter CreateFileW AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcessId CreateThread GetExitCodeProcess GetTickCount64 GetSystemDirectoryW VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA AddDllDirectory SetDefaultDllDirectories QueryFullProcessImageNameW SetDllDirectoryW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection GetTickCount LocalFree LoadLibraryW SleepEx GetSystemInfo MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx VirtualFreeEx GetFileAttributesExW FindFirstFileW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW GetFileInformationByHandleEx WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsDebuggerPresent OutputDebugStringW CreateRemoteThread GetModuleHandleW ReadProcessMemory VirtualAllocEx GetProcAddress VirtualProtectEx LoadLibraryA GetLastError RtlAddFunctionTable WriteProcessMemory CloseHandle Process32FirstW Process32NextW Sleep CreateToolhelp32Snapshot OpenProcess GetModuleFileNameW GetCurrentProcess SetFileInformationByHandle CreateFile2 AreFileApisANSI LeaveCriticalSection GetCurrentThreadId

user32

SetCursorPos ReleaseCapture GetClipboardData SetClipboardData IsWindowUnicode DefWindowProcW DestroyWindow CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW EmptyClipboard MessageBoxA SetLayeredWindowAttributes TranslateMessage LoadIconW LoadCursorW PostQuitMessage UpdateWindow GetCursorPos GetCapture CloseClipboard GetClientRect SetCursor SetCapture OpenClipboard GetForegroundWindow GetKeyboardLayout TrackMouseEvent PeekMessageW GetKeyState GetMessageExtraInfo ClientToScreen

msvcp140

_Query_perf_counter _Thrd_detach _Mtx_unlock ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit ?_Xinvalid_argument@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ _Xtime_get_ticks ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Mtx_lock ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

crypt32

CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CertFreeCertificateChain CryptQueryObject CertGetCertificateChain

ws2_32

sendto ioctlsocket gethostname ntohl htonl accept select __WSAFDIsSet listen recvfrom WSAIoctl socket getaddrinfo setsockopt recv htons getsockname freeaddrinfo getpeername inet_pton connect inet_ntop bind getsockopt WSACleanup WSAStartup send WSACloseEvent WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSACreateEvent WSAEnumNetworkEvents WSAResetEvent WSAEventSelect

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset strrchr strstr memmove memchr wcschr __C_specific_handler __current_exception memcmp memcpy __current_exception_context _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate wcsrchr strchr

api-ms-win-crt-stdio-l1-1-0

fseek __p__commode __stdio_common_vsnprintf_s _get_stream_buffer_pointers fclose fflush __acrt_iob_func __stdio_common_vfprintf _wopen fputc _lseeki64 _read _write _wfopen fputs _fileno _close ftell __stdio_common_vsscanf _popen _fseeki64 fread fsetpos fgetc _pclose feof ungetc fgets setvbuf fgetpos __stdio_common_vsprintf _set_fmode fwrite

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc calloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

ldexp _dsign sqrtf powf _dclass pow fmodf cosf _fdopen sinf acosf ceilf __setusermatherr

api-ms-win-crt-string-l1-1-0

strncpy _strdup wcsncpy strpbrk wcsncmp _wcsicmp _stricmp strspn wcspbrk strncmp strcspn _wcsdup wcslen strlen strcmp towlower isxdigit isspace tolower

api-ms-win-crt-convert-l1-1-0

strtol wcstombs strtoull strtoul strtod atoi strtoll

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file _fstat64 _lock_file remove _wstat64

api-ms-win-crt-runtime-l1-1-0

abort _resetstkoflw _invoke_watson __sys_nerr __sys_errlist terminate _crt_atexit _register_onexit_function _initialize_onexit_table _invalid_parameter_noinfo system _beginthreadex exit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e _exit _register_thread_local_exe_atexit_callback _cexit _c_exit _errno

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 _gmtime64 strftime _localtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

srand qsort