Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 13:39
Static task
static1
Behavioral task
behavioral1
Sample
swift copy.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
swift copy.exe
Resource
win10v2004-20240508-en
General
-
Target
swift copy.exe
-
Size
1.1MB
-
MD5
e9c6a41856090c8eb226b8342166c58a
-
SHA1
217fdcfe9df26442e307ba60ebef9255633f13b8
-
SHA256
491951b8a84f49dd5a5c0bdea5370223a8ac834d47d53a526f628733325dd5c9
-
SHA512
d2a99a05836dd861badc291952db513bcdfb0b5b7f18e733c9fff01ed85559391d1f1dac3ef1ea21ba870fc827ad95db25be98f58132fa59bbc3fdaf2e765ebe
-
SSDEEP
24576:8AHnh+eWsN3skA4RV1Hom2KXMmHa46VQzGOd23X5:bh+ZkldoPK8Ya46qzLdE
Malware Config
Extracted
formbook
4.1
as02
qwin777.com
robinhoods.live
h3jh-dal.pics
braindeadcopywriting.com
kktcbet1000.com
mpo0463.cfd
raboteshoes.com
ab1718.com
lowcrusiers.com
gregcopelandmusic.com
dkfndch.store
firstclassuni.com
00ewu1ub.com
shunweichemical.com
sugarits.com
marqify.com
mistmajik.com
trezip.online
tinytables.xyz
suestergocoaching.com
dominoad.com
specials.website
thatpilatesgirl.com
vrexpressok.com
sdegtho.com
svhomesinspections.com
rumbol88.com
dzplricfpf.com
fastcoolify.com
bloominginwholeness.com
12ser3.com
curtsreno.com
defx.ventures
dev-patel.xyz
ltyidc.com
wheiunudweowuqiwuebfyewui3.com
039c5m2ciwt99.top
pmpm.xyz
akabuka.net
parkerslandscapingllc.com
hamcast.com
jiangcapable.site
sassysensoryclips.com
arsalan.shop
thecryptocaviar.com
ofbsconsulting.com
j8j3e.cfd
cinexgltd.com
justcallnadia.com
qcyiran.com
uniseekglobal.com
milieunightclub.com
sisasimoslot.com
svizzblem.net
20644.asia
shroomberparty.com
contractcrafters.net
selectstylehome.shop
blackhillspr.com
topsolutionquality.online
diywithbje.com
simplywellcoach.com
popothebear.site
entendiendomedicare.com
sopaindam.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2152-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2152-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2152-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2956-24-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
swift copy.exesvchost.exewuapp.exedescription pid process target process PID 1968 set thread context of 2152 1968 swift copy.exe svchost.exe PID 2152 set thread context of 1308 2152 svchost.exe Explorer.EXE PID 2152 set thread context of 1308 2152 svchost.exe Explorer.EXE PID 2956 set thread context of 1308 2956 wuapp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
svchost.exewuapp.exepid process 2152 svchost.exe 2152 svchost.exe 2152 svchost.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe 2956 wuapp.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
swift copy.exesvchost.exewuapp.exepid process 1968 swift copy.exe 2152 svchost.exe 2152 svchost.exe 2152 svchost.exe 2152 svchost.exe 2956 wuapp.exe 2956 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exewuapp.exedescription pid process Token: SeDebugPrivilege 2152 svchost.exe Token: SeDebugPrivilege 2956 wuapp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
swift copy.exeExplorer.EXEpid process 1968 swift copy.exe 1968 swift copy.exe 1308 Explorer.EXE 1308 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
swift copy.exepid process 1968 swift copy.exe 1968 swift copy.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
swift copy.exeExplorer.EXEwuapp.exedescription pid process target process PID 1968 wrote to memory of 2152 1968 swift copy.exe svchost.exe PID 1968 wrote to memory of 2152 1968 swift copy.exe svchost.exe PID 1968 wrote to memory of 2152 1968 swift copy.exe svchost.exe PID 1968 wrote to memory of 2152 1968 swift copy.exe svchost.exe PID 1968 wrote to memory of 2152 1968 swift copy.exe svchost.exe PID 1308 wrote to memory of 2956 1308 Explorer.EXE wuapp.exe PID 1308 wrote to memory of 2956 1308 Explorer.EXE wuapp.exe PID 1308 wrote to memory of 2956 1308 Explorer.EXE wuapp.exe PID 1308 wrote to memory of 2956 1308 Explorer.EXE wuapp.exe PID 1308 wrote to memory of 2956 1308 Explorer.EXE wuapp.exe PID 1308 wrote to memory of 2956 1308 Explorer.EXE wuapp.exe PID 1308 wrote to memory of 2956 1308 Explorer.EXE wuapp.exe PID 2956 wrote to memory of 2772 2956 wuapp.exe cmd.exe PID 2956 wrote to memory of 2772 2956 wuapp.exe cmd.exe PID 2956 wrote to memory of 2772 2956 wuapp.exe cmd.exe PID 2956 wrote to memory of 2772 2956 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift copy.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-26-0x0000000004080000-0x000000000415A000-memory.dmpFilesize
872KB
-
memory/1308-28-0x0000000006C20000-0x0000000006D6E000-memory.dmpFilesize
1.3MB
-
memory/1308-20-0x0000000006C20000-0x0000000006D6E000-memory.dmpFilesize
1.3MB
-
memory/1308-36-0x0000000008FA0000-0x000000000912C000-memory.dmpFilesize
1.5MB
-
memory/1308-32-0x0000000008FA0000-0x000000000912C000-memory.dmpFilesize
1.5MB
-
memory/1308-16-0x0000000004080000-0x000000000415A000-memory.dmpFilesize
872KB
-
memory/1308-31-0x0000000008FA0000-0x000000000912C000-memory.dmpFilesize
1.5MB
-
memory/1968-10-0x0000000000170000-0x0000000000174000-memory.dmpFilesize
16KB
-
memory/2152-12-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/2152-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2152-18-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2152-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2152-19-0x0000000000210000-0x0000000000225000-memory.dmpFilesize
84KB
-
memory/2152-15-0x00000000001D0000-0x00000000001E5000-memory.dmpFilesize
84KB
-
memory/2956-23-0x0000000000FE0000-0x0000000000FEB000-memory.dmpFilesize
44KB
-
memory/2956-24-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/2956-21-0x0000000000FE0000-0x0000000000FEB000-memory.dmpFilesize
44KB