Edit tour

Windows Analysis Report
SWIFT.exe

Overview

General Information

Sample name:	SWIFT.exe
Analysis ID:	1431498
MD5:	c3783358a70c67db7ba565a68872b2d6
SHA1:	e0c97fdd090069d6fb47589643fad0d8365b537a
SHA256:	2e546d749c2e13895babd1d2bca41978605c1ba3967ca0b21709646120704760
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SWIFT.exe (PID: 1960 cmdline: "C:\Users\user\Desktop\SWIFT.exe" MD5: C3783358A70C67DB7BA565A68872B2D6)

MSBuild.exe (PID: 5064 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 5796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.quoctoan.vn", "Username": "long_xnk@quoctoan.vn", "Password": "bGMJNaGYNTLC"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3245436957.00000000032A6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2036561499.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3245436957.000000000329E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2034008651.0000000004309000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3245436957.0000000003251000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3245436957.0000000003251000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SWIFT.exe PID: 1960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SWIFT.exe PID: 1960	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SWIFT.exe PID: 1960	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 5796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 5796	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SWIFT.exe.4309970.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SWIFT.exe.5af0000.12.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SWIFT.exe.5af0000.12.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SWIFT.exe.4309970.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SWIFT.exe.5098988.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SWIFT.exe.5098988.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SWIFT.exe.5098988.10.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3175d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31879:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31955:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33679:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33755:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SWIFT.exe.505df68.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SWIFT.exe.505df68.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SWIFT.exe.505df68.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3175d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31879:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31955:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SWIFT.exe.5098988.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SWIFT.exe.5098988.10.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SWIFT.exe.5098988.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd0b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd7d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de07:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33679:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de99:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df03:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33755:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df75:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e00b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e09b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SWIFT.exe.505df68.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SWIFT.exe.505df68.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SWIFT.exe.505df68.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df0b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa872b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df7d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa879d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e007:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8827:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33679:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e099:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa88b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e103:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8923:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33755:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e175:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8995:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e20b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a2b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 14 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 112.213.92.152, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 5796, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Snort Signatures

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 112.213.92.152

Timestamp:	04/25/24-10:38:01.777560
SID:	2839723
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 112.213.92.152

Timestamp:	04/25/24-10:38:01.777589
SID:	2851779
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 112.213.92.152

Timestamp:	04/25/24-10:38:01.777589
SID:	2840032
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 112.213.92.152

Timestamp:	04/25/24-10:38:01.777589
SID:	2855542
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 112.213.92.152

Timestamp:	04/25/24-10:38:01.777589
SID:	2855245
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 112.213.92.152

Timestamp:	04/25/24-10:38:01.777560
SID:	2030171
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.SWIFT.exe.505df68.9.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.quoctoan.vn", "Username": "long_xnk@quoctoan.vn", "Password": "bGMJNaGYNTLC"}

Multi AV Scanner detection for submitted file

Source: SWIFT.exe	ReversingLabs: Detection: 52%
Source: SWIFT.exe	Virustotal: Detection: 53%			Perma Link

Machine Learning detection for sample

Source: SWIFT.exe

Joe Sandbox ML: detected

Source: SWIFT.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49710 version: TLS 1.0

Source: SWIFT.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: qfffT.pdb source: SWIFT.exe
Source:	Binary string: qfffT.pdbSHA256 source: SWIFT.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49704 -> 112.213.92.152:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49704 -> 112.213.92.152:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49704 -> 112.213.92.152:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49704 -> 112.213.92.152:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49704 -> 112.213.92.152:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49704 -> 112.213.92.152:587

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 112.213.92.152:587

Source: Joe Sandbox View

ASN Name: SUPERDATA-AS-VNSUPERDATA-VN SUPERDATA-AS-VNSUPERDATA-VN

Source: Joe Sandbox View

JA3 fingerprint: 1138de370e523e824bbca92d049a3777

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 112.213.92.152:587

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49710 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.quoctoan.vn

Source: MSBuild.exe, 00000003.00000002.3245436957.00000000032A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.quoctoan.vn
Source: MSBuild.exe, 00000003.00000002.3245436957.00000000032A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail92152.maychuemail.com
Source: SWIFT.exe, 00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, 7KG.cs	.Net Code: _0MhZfg
Source: 0.2.SWIFT.exe.5098988.10.raw.unpack, 7KG.cs	.Net Code: _0MhZfg

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SWIFT.exe.5098988.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SWIFT.exe.505df68.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SWIFT.exe.5098988.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_0197D5BC	0_2_0197D5BC
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058BD2F8	0_2_058BD2F8
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058BDCC8	0_2_058BDCC8
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058B6BE8	0_2_058B6BE8
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058B0006	0_2_058B0006
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058B0040	0_2_058B0040
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058BDCB7	0_2_058BDCB7
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058B6BD8	0_2_058B6BD8
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058BDA20	0_2_058BDA20
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_058BDA30	0_2_058BDA30
Source: C:\Users\user\Desktop\SWIFT.exe	Code function: 0_2_08A60C90	0_2_08A60C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_030A9380	3_2_030A9380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_030A9B30	3_2_030A9B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_030A4A98	3_2_030A4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_030ACE78	3_2_030ACE78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_030A3E80	3_2_030A3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_030A41C8	3_2_030A41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067C56C8	3_2_067C56C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067C3F40	3_2_067C3F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067CBCE8	3_2_067CBCE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067CDD00	3_2_067CDD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067C05B8	3_2_067C05B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067C2AE8	3_2_067C2AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067C9AC8	3_2_067C9AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067C8B70	3_2_067C8B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067C4FE8	3_2_067C4FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_067C3240	3_2_067C3240

Source: SWIFT.exe, 00000000.00000002.2035633292.0000000005300000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SWIFT.exe
Source: SWIFT.exe, 00000000.00000002.2034008651.0000000004CF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SWIFT.exe
Source: SWIFT.exe, 00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed73c8e00-3a74-4257-91f6-3323ac15dd71.exe4 vs SWIFT.exe
Source: SWIFT.exe, 00000000.00000002.2033159770.0000000003450000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed73c8e00-3a74-4257-91f6-3323ac15dd71.exe4 vs SWIFT.exe
Source: SWIFT.exe, 00000000.00000002.2032212634.000000000152E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SWIFT.exe
Source: SWIFT.exe	Binary or memory string: OriginalFilenameqfffT.exen' vs SWIFT.exe

Source: SWIFT.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.SWIFT.exe.5098988.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SWIFT.exe.505df68.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SWIFT.exe.5098988.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SWIFT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, 1UT6pzc0M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, DnQOD3M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, 01seU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, iUDwvr7Gz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, XUu2qKyuF6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, aZathEIgR.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWIFT.exe.505df68.9.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, LTAbF3ZUBqJsYnuwhW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, LTAbF3ZUBqJsYnuwhW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, fBIFARM1dNcGpWBBWF.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, LTAbF3ZUBqJsYnuwhW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@5/1@2/1

Source: C:\Users\user\Desktop\SWIFT.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\SWIFT.exe	Mutant created: \Sessions\1\BaseNamedObjects\iHxXkwdIHBKIctgXRIdWSFXFQuT

Source: SWIFT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SWIFT.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SWIFT.exe	ReversingLabs: Detection: 52%
Source: SWIFT.exe	Virustotal: Detection: 53%

Source: unknown	Process created: C:\Users\user\Desktop\SWIFT.exe "C:\Users\user\Desktop\SWIFT.exe"
Source: C:\Users\user\Desktop\SWIFT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SWIFT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SWIFT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SWIFT.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SWIFT.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SWIFT.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: qfffT.pdb source: SWIFT.exe
Source:	Binary string: qfffT.pdbSHA256 source: SWIFT.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.SWIFT.exe.5af0000.12.raw.unpack, V4uC3Iifq56IKQcfry.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: SWIFT.exe, Form1.cs	.Net Code: InitializeComponent
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, fBIFARM1dNcGpWBBWF.cs	.Net Code: pXkDf2woh5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, fBIFARM1dNcGpWBBWF.cs	.Net Code: pXkDf2woh5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, fBIFARM1dNcGpWBBWF.cs	.Net Code: pXkDf2woh5 System.Reflection.Assembly.Load(byte[])

Source: SWIFT.exe

Static PE information: 0xF3EC99AE [Sun Sep 6 09:15:26 2099 UTC]

Source: SWIFT.exe

Static PE information: section name: .text entropy: 7.9848971240460545

Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, l3uKDiGEukCXQ10mb1.cs	High entropy of concatenated method names: 'K6dfnkDS5', 'ms6FqFT5r', 'yP5Pkef6Q', 'hDGArSZrf', 'MpXoojA50', 'SYBhjNu1r', 'I4t0mYQSfa1vTGMeQc', 'eqMsFv2kM25xF444NG', 'GaUI0CkIX', 'zyaWtYqru'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, DNjYqavbeRfGYMOMNx.cs	High entropy of concatenated method names: 'VgLHZOIS4c', 'iiNHoMM8SB', 'xZtHKTpDEM', 'wq9HeNkVXt', 'yYSHBxDPKH', 'OmDHtoAW1W', 'XiAH8mXFH9', 'wvTH0XGyYi', 'gh6HJZChsE', 'bvEH2FpNXx'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, il3qo0bBxWcPXwwvUq.cs	High entropy of concatenated method names: 'ToString', 'JchY2qlZhU', 'rNOYeBB7q9', 'QAyYXpaQbZ', 'FPKYBbEOFK', 'WwyYtMeGp2', 'klQYl4oqg5', 'guoY8wB94n', 'mLOY02t0DD', 'fXiY3SWYbG'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, yJ5mACQQOvtCvII9Xry.cs	High entropy of concatenated method names: 'ToString', 'kFwW9gcw8j', 'akdWD7LW0u', 'iG0WwNDVMe', 'Q4DW5If8lf', 'KIsWTMMkev', 'xXCWCOd5YY', 'mjoWRYcokE', 'K8gSeWYZcvf464xi9qk', 'UESJrWYr7bCauaE12DJ'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, WE8gUVL1pn26BaBie1.cs	High entropy of concatenated method names: 'XUwIKU0jE0', 'grfIeTpI0h', 'FkDIXTcRwG', 'c4CIBJmqql', 'WwfI194RFr', 'eCbItENhha', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, fBIFARM1dNcGpWBBWF.cs	High entropy of concatenated method names: 'QJ19wAWq5Y', 'OUh95bGpWl', 'OWL9TSyJZM', 'mCt9Cut4WZ', 'fdO9RQ1Bc9', 'mMh9c6shW1', 'd2A9iWeFsw', 'dbK9MDmYHI', 'dbE9p39U5i', 'Se09khV9BS'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, IMHNqa1GwxHuBX79pe.cs	High entropy of concatenated method names: 'Q007J9Opin', 'wIA7SfIy8n', 'MnK71Fgd3l', 'eJG7EyJppi', 'rFL7eCq3bc', 'Isq7XwlW7j', 'OBk7BG7sRK', 'Vau7tpVoip', 'R0E7luX35Z', 'hX478Ei0mh'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, Pb2E018WVNi9US0kvR.cs	High entropy of concatenated method names: 'zM6i5E90sl', 'PgXiCxmeLG', 'bGKicgDURM', 'laOcaB8fTY', 'HOPczk4OdM', 'bP3iUsAuJO', 'G0biQPHL7Q', 'DDtiGTJBoS', 'QQ2i9paUlR', 'aoxiDgkUY4'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, X80DMSQ97ppGTWh50QH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GPMW1ZnWeJ', 'HjPWEvaUrt', 'dcUWbBoeUQ', 'ipGWjGmXn0', 'jh6WnmTJQA', 'xyVWxts2a8', 'j2fWVm2Dph'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, OAkLgt3hVcB8a4TNPx.cs	High entropy of concatenated method names: 'vBxi6UpN9B', 'XgVi4lyq0L', 'IfTifab76N', 'XQAiFJ9SWq', 'gTRiy3y09i', 'M1uiP7TuAv', 'LfHiADZFaR', 'UD2iZk02y0', 'oUhioYfEe6', 'Pd4ihbso1S'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, uY4pkiqDqX0kyNCuhi.cs	High entropy of concatenated method names: 'XaxI57FQqO', 'n9rITsxy0A', 'TcPICPBBWB', 'cAGIRq9DLd', 'ATSIclExRT', 'gBLIi8iNQQ', 'ALLIMR7WH5', 'JxnIpBp5hp', 'VDDIkWNKMk', 'F8CIdIeF98'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, GDG5GMxJTp6njGdYES.cs	High entropy of concatenated method names: 'FNpuqpxNnm', 'mIMuaEbPcO', 'qxHIUBZgXQ', 'RKrIQrMKov', 'ucKu2XSbxw', 'k0IuScc3Qn', 'gBSuvIMO57', 'cTbu1RQEHn', 'JnduEAHEEg', 'RDwub82bSL'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, dZ7lISDHl5QeJd73Tb.cs	High entropy of concatenated method names: 'Gl8QiTAbF3', 'aBqQMJsYnu', 'aLlQkSOtTS', 'Fh7Qdd4FBb', 'scJQ7h5MbI', 'btXQYVwrlc', 'fD64FhAasOnoDhouFl', 'gFQJpqZ9RM2AuYfsHs', 'amNQQKW9rE', 'Q6vQ9DI7cm'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, zOZnVUoLlSOtTSKh7d.cs	High entropy of concatenated method names: 'vPXCFQ68Zm', 'zfyCPH8sOY', 'mIGCZSCMgw', 'xoHCoF8Off', 'fFIC7UUryX', 'pxbCY3aNBp', 'BKJCulHbU5', 'updCI2X4TX', 'xttCOKyxTp', 'wguCWrndS2'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, CvEX3yQUapj0dPs76S0.cs	High entropy of concatenated method names: 'wybO6t6uuQ', 'mq4O4kMn0v', 'yjmOfC8mNW', 'oe0OFsIc03', 'KekOyJPamB', 'PqYOPeIdrN', 'I1mOAr30br', 'k3cOZZNPwN', 'pGmOore6GS', 'LLFOhYrQWl'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, QUMQenaZE0bN9GbMZg.cs	High entropy of concatenated method names: 'IK9OQmU98V', 'FtKO9sx9T7', 'jweODCXuDu', 'sLnO5ReX9i', 'xsDOTypdft', 'UmFORwnMd4', 'nD5OcvAQDF', 'DycIV4RDy2', 'SW2IqwiqP2', 'HLAIL1dXk5'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, kbIQtXKVwrlcFiSqxx.cs	High entropy of concatenated method names: 'g9Icw0d8Ao', 'AoZcTEk1Tg', 'JRpcRBWDYL', 's1ZciqN2PK', 'jPycMpL3nv', 'yF5RnmfGCv', 'InsRxJOmQ6', 'A2RRVNPTDK', 'iLjRqd0DB0', 'tBqRLCiitR'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, LTAbF3ZUBqJsYnuwhW.cs	High entropy of concatenated method names: 'sCHT16FA56', 'qY6TEqYnmK', 'pGcTbYxUkK', 'lsiTjmvvXt', 'PWHTnkXG5Y', 'aKbTxToV0D', 'bF8TVO1r8B', 'NQZTqOJ0Br', 'pZiTLWaotn', 'E90TaFB3bP'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, BUANBPjKABgFDh7hbJ.cs	High entropy of concatenated method names: 'BAEuk8McdZ', 'l9rudYcI30', 'ToString', 'o3Hu5Xd5VC', 'tcYuTbcfCj', 'mdEuC0qV83', 'kWXuRssVSy', 'X6yucdjPmE', 'FcQui8hO5i', 'KNCuMcU7FL'
Source: 0.2.SWIFT.exe.4f02210.8.raw.unpack, as7UGTTrgSge76n5y2.cs	High entropy of concatenated method names: 'Dispose', 'iiyQLexZb8', 'elLGeFcgJs', 'RVissELPgg', 'emYQa4pkiD', 'WX0QzkyNCu', 'ProcessDialogKey', 'FiqGUE8gUV', 'RpnGQ26BaB', 'je1GGvUMQe'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, l3uKDiGEukCXQ10mb1.cs	High entropy of concatenated method names: 'K6dfnkDS5', 'ms6FqFT5r', 'yP5Pkef6Q', 'hDGArSZrf', 'MpXoojA50', 'SYBhjNu1r', 'I4t0mYQSfa1vTGMeQc', 'eqMsFv2kM25xF444NG', 'GaUI0CkIX', 'zyaWtYqru'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, DNjYqavbeRfGYMOMNx.cs	High entropy of concatenated method names: 'VgLHZOIS4c', 'iiNHoMM8SB', 'xZtHKTpDEM', 'wq9HeNkVXt', 'yYSHBxDPKH', 'OmDHtoAW1W', 'XiAH8mXFH9', 'wvTH0XGyYi', 'gh6HJZChsE', 'bvEH2FpNXx'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, il3qo0bBxWcPXwwvUq.cs	High entropy of concatenated method names: 'ToString', 'JchY2qlZhU', 'rNOYeBB7q9', 'QAyYXpaQbZ', 'FPKYBbEOFK', 'WwyYtMeGp2', 'klQYl4oqg5', 'guoY8wB94n', 'mLOY02t0DD', 'fXiY3SWYbG'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, yJ5mACQQOvtCvII9Xry.cs	High entropy of concatenated method names: 'ToString', 'kFwW9gcw8j', 'akdWD7LW0u', 'iG0WwNDVMe', 'Q4DW5If8lf', 'KIsWTMMkev', 'xXCWCOd5YY', 'mjoWRYcokE', 'K8gSeWYZcvf464xi9qk', 'UESJrWYr7bCauaE12DJ'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, WE8gUVL1pn26BaBie1.cs	High entropy of concatenated method names: 'XUwIKU0jE0', 'grfIeTpI0h', 'FkDIXTcRwG', 'c4CIBJmqql', 'WwfI194RFr', 'eCbItENhha', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, fBIFARM1dNcGpWBBWF.cs	High entropy of concatenated method names: 'QJ19wAWq5Y', 'OUh95bGpWl', 'OWL9TSyJZM', 'mCt9Cut4WZ', 'fdO9RQ1Bc9', 'mMh9c6shW1', 'd2A9iWeFsw', 'dbK9MDmYHI', 'dbE9p39U5i', 'Se09khV9BS'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, IMHNqa1GwxHuBX79pe.cs	High entropy of concatenated method names: 'Q007J9Opin', 'wIA7SfIy8n', 'MnK71Fgd3l', 'eJG7EyJppi', 'rFL7eCq3bc', 'Isq7XwlW7j', 'OBk7BG7sRK', 'Vau7tpVoip', 'R0E7luX35Z', 'hX478Ei0mh'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, Pb2E018WVNi9US0kvR.cs	High entropy of concatenated method names: 'zM6i5E90sl', 'PgXiCxmeLG', 'bGKicgDURM', 'laOcaB8fTY', 'HOPczk4OdM', 'bP3iUsAuJO', 'G0biQPHL7Q', 'DDtiGTJBoS', 'QQ2i9paUlR', 'aoxiDgkUY4'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, X80DMSQ97ppGTWh50QH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GPMW1ZnWeJ', 'HjPWEvaUrt', 'dcUWbBoeUQ', 'ipGWjGmXn0', 'jh6WnmTJQA', 'xyVWxts2a8', 'j2fWVm2Dph'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, OAkLgt3hVcB8a4TNPx.cs	High entropy of concatenated method names: 'vBxi6UpN9B', 'XgVi4lyq0L', 'IfTifab76N', 'XQAiFJ9SWq', 'gTRiy3y09i', 'M1uiP7TuAv', 'LfHiADZFaR', 'UD2iZk02y0', 'oUhioYfEe6', 'Pd4ihbso1S'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, uY4pkiqDqX0kyNCuhi.cs	High entropy of concatenated method names: 'XaxI57FQqO', 'n9rITsxy0A', 'TcPICPBBWB', 'cAGIRq9DLd', 'ATSIclExRT', 'gBLIi8iNQQ', 'ALLIMR7WH5', 'JxnIpBp5hp', 'VDDIkWNKMk', 'F8CIdIeF98'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, GDG5GMxJTp6njGdYES.cs	High entropy of concatenated method names: 'FNpuqpxNnm', 'mIMuaEbPcO', 'qxHIUBZgXQ', 'RKrIQrMKov', 'ucKu2XSbxw', 'k0IuScc3Qn', 'gBSuvIMO57', 'cTbu1RQEHn', 'JnduEAHEEg', 'RDwub82bSL'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, dZ7lISDHl5QeJd73Tb.cs	High entropy of concatenated method names: 'Gl8QiTAbF3', 'aBqQMJsYnu', 'aLlQkSOtTS', 'Fh7Qdd4FBb', 'scJQ7h5MbI', 'btXQYVwrlc', 'fD64FhAasOnoDhouFl', 'gFQJpqZ9RM2AuYfsHs', 'amNQQKW9rE', 'Q6vQ9DI7cm'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, zOZnVUoLlSOtTSKh7d.cs	High entropy of concatenated method names: 'vPXCFQ68Zm', 'zfyCPH8sOY', 'mIGCZSCMgw', 'xoHCoF8Off', 'fFIC7UUryX', 'pxbCY3aNBp', 'BKJCulHbU5', 'updCI2X4TX', 'xttCOKyxTp', 'wguCWrndS2'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, CvEX3yQUapj0dPs76S0.cs	High entropy of concatenated method names: 'wybO6t6uuQ', 'mq4O4kMn0v', 'yjmOfC8mNW', 'oe0OFsIc03', 'KekOyJPamB', 'PqYOPeIdrN', 'I1mOAr30br', 'k3cOZZNPwN', 'pGmOore6GS', 'LLFOhYrQWl'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, QUMQenaZE0bN9GbMZg.cs	High entropy of concatenated method names: 'IK9OQmU98V', 'FtKO9sx9T7', 'jweODCXuDu', 'sLnO5ReX9i', 'xsDOTypdft', 'UmFORwnMd4', 'nD5OcvAQDF', 'DycIV4RDy2', 'SW2IqwiqP2', 'HLAIL1dXk5'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, kbIQtXKVwrlcFiSqxx.cs	High entropy of concatenated method names: 'g9Icw0d8Ao', 'AoZcTEk1Tg', 'JRpcRBWDYL', 's1ZciqN2PK', 'jPycMpL3nv', 'yF5RnmfGCv', 'InsRxJOmQ6', 'A2RRVNPTDK', 'iLjRqd0DB0', 'tBqRLCiitR'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, LTAbF3ZUBqJsYnuwhW.cs	High entropy of concatenated method names: 'sCHT16FA56', 'qY6TEqYnmK', 'pGcTbYxUkK', 'lsiTjmvvXt', 'PWHTnkXG5Y', 'aKbTxToV0D', 'bF8TVO1r8B', 'NQZTqOJ0Br', 'pZiTLWaotn', 'E90TaFB3bP'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, BUANBPjKABgFDh7hbJ.cs	High entropy of concatenated method names: 'BAEuk8McdZ', 'l9rudYcI30', 'ToString', 'o3Hu5Xd5VC', 'tcYuTbcfCj', 'mdEuC0qV83', 'kWXuRssVSy', 'X6yucdjPmE', 'FcQui8hO5i', 'KNCuMcU7FL'
Source: 0.2.SWIFT.exe.5300000.11.raw.unpack, as7UGTTrgSge76n5y2.cs	High entropy of concatenated method names: 'Dispose', 'iiyQLexZb8', 'elLGeFcgJs', 'RVissELPgg', 'emYQa4pkiD', 'WX0QzkyNCu', 'ProcessDialogKey', 'FiqGUE8gUV', 'RpnGQ26BaB', 'je1GGvUMQe'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, l3uKDiGEukCXQ10mb1.cs	High entropy of concatenated method names: 'K6dfnkDS5', 'ms6FqFT5r', 'yP5Pkef6Q', 'hDGArSZrf', 'MpXoojA50', 'SYBhjNu1r', 'I4t0mYQSfa1vTGMeQc', 'eqMsFv2kM25xF444NG', 'GaUI0CkIX', 'zyaWtYqru'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, DNjYqavbeRfGYMOMNx.cs	High entropy of concatenated method names: 'VgLHZOIS4c', 'iiNHoMM8SB', 'xZtHKTpDEM', 'wq9HeNkVXt', 'yYSHBxDPKH', 'OmDHtoAW1W', 'XiAH8mXFH9', 'wvTH0XGyYi', 'gh6HJZChsE', 'bvEH2FpNXx'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, il3qo0bBxWcPXwwvUq.cs	High entropy of concatenated method names: 'ToString', 'JchY2qlZhU', 'rNOYeBB7q9', 'QAyYXpaQbZ', 'FPKYBbEOFK', 'WwyYtMeGp2', 'klQYl4oqg5', 'guoY8wB94n', 'mLOY02t0DD', 'fXiY3SWYbG'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, yJ5mACQQOvtCvII9Xry.cs	High entropy of concatenated method names: 'ToString', 'kFwW9gcw8j', 'akdWD7LW0u', 'iG0WwNDVMe', 'Q4DW5If8lf', 'KIsWTMMkev', 'xXCWCOd5YY', 'mjoWRYcokE', 'K8gSeWYZcvf464xi9qk', 'UESJrWYr7bCauaE12DJ'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, WE8gUVL1pn26BaBie1.cs	High entropy of concatenated method names: 'XUwIKU0jE0', 'grfIeTpI0h', 'FkDIXTcRwG', 'c4CIBJmqql', 'WwfI194RFr', 'eCbItENhha', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, fBIFARM1dNcGpWBBWF.cs	High entropy of concatenated method names: 'QJ19wAWq5Y', 'OUh95bGpWl', 'OWL9TSyJZM', 'mCt9Cut4WZ', 'fdO9RQ1Bc9', 'mMh9c6shW1', 'd2A9iWeFsw', 'dbK9MDmYHI', 'dbE9p39U5i', 'Se09khV9BS'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, IMHNqa1GwxHuBX79pe.cs	High entropy of concatenated method names: 'Q007J9Opin', 'wIA7SfIy8n', 'MnK71Fgd3l', 'eJG7EyJppi', 'rFL7eCq3bc', 'Isq7XwlW7j', 'OBk7BG7sRK', 'Vau7tpVoip', 'R0E7luX35Z', 'hX478Ei0mh'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, Pb2E018WVNi9US0kvR.cs	High entropy of concatenated method names: 'zM6i5E90sl', 'PgXiCxmeLG', 'bGKicgDURM', 'laOcaB8fTY', 'HOPczk4OdM', 'bP3iUsAuJO', 'G0biQPHL7Q', 'DDtiGTJBoS', 'QQ2i9paUlR', 'aoxiDgkUY4'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, X80DMSQ97ppGTWh50QH.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GPMW1ZnWeJ', 'HjPWEvaUrt', 'dcUWbBoeUQ', 'ipGWjGmXn0', 'jh6WnmTJQA', 'xyVWxts2a8', 'j2fWVm2Dph'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, OAkLgt3hVcB8a4TNPx.cs	High entropy of concatenated method names: 'vBxi6UpN9B', 'XgVi4lyq0L', 'IfTifab76N', 'XQAiFJ9SWq', 'gTRiy3y09i', 'M1uiP7TuAv', 'LfHiADZFaR', 'UD2iZk02y0', 'oUhioYfEe6', 'Pd4ihbso1S'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, uY4pkiqDqX0kyNCuhi.cs	High entropy of concatenated method names: 'XaxI57FQqO', 'n9rITsxy0A', 'TcPICPBBWB', 'cAGIRq9DLd', 'ATSIclExRT', 'gBLIi8iNQQ', 'ALLIMR7WH5', 'JxnIpBp5hp', 'VDDIkWNKMk', 'F8CIdIeF98'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, GDG5GMxJTp6njGdYES.cs	High entropy of concatenated method names: 'FNpuqpxNnm', 'mIMuaEbPcO', 'qxHIUBZgXQ', 'RKrIQrMKov', 'ucKu2XSbxw', 'k0IuScc3Qn', 'gBSuvIMO57', 'cTbu1RQEHn', 'JnduEAHEEg', 'RDwub82bSL'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, dZ7lISDHl5QeJd73Tb.cs	High entropy of concatenated method names: 'Gl8QiTAbF3', 'aBqQMJsYnu', 'aLlQkSOtTS', 'Fh7Qdd4FBb', 'scJQ7h5MbI', 'btXQYVwrlc', 'fD64FhAasOnoDhouFl', 'gFQJpqZ9RM2AuYfsHs', 'amNQQKW9rE', 'Q6vQ9DI7cm'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, zOZnVUoLlSOtTSKh7d.cs	High entropy of concatenated method names: 'vPXCFQ68Zm', 'zfyCPH8sOY', 'mIGCZSCMgw', 'xoHCoF8Off', 'fFIC7UUryX', 'pxbCY3aNBp', 'BKJCulHbU5', 'updCI2X4TX', 'xttCOKyxTp', 'wguCWrndS2'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, CvEX3yQUapj0dPs76S0.cs	High entropy of concatenated method names: 'wybO6t6uuQ', 'mq4O4kMn0v', 'yjmOfC8mNW', 'oe0OFsIc03', 'KekOyJPamB', 'PqYOPeIdrN', 'I1mOAr30br', 'k3cOZZNPwN', 'pGmOore6GS', 'LLFOhYrQWl'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, QUMQenaZE0bN9GbMZg.cs	High entropy of concatenated method names: 'IK9OQmU98V', 'FtKO9sx9T7', 'jweODCXuDu', 'sLnO5ReX9i', 'xsDOTypdft', 'UmFORwnMd4', 'nD5OcvAQDF', 'DycIV4RDy2', 'SW2IqwiqP2', 'HLAIL1dXk5'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, kbIQtXKVwrlcFiSqxx.cs	High entropy of concatenated method names: 'g9Icw0d8Ao', 'AoZcTEk1Tg', 'JRpcRBWDYL', 's1ZciqN2PK', 'jPycMpL3nv', 'yF5RnmfGCv', 'InsRxJOmQ6', 'A2RRVNPTDK', 'iLjRqd0DB0', 'tBqRLCiitR'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, LTAbF3ZUBqJsYnuwhW.cs	High entropy of concatenated method names: 'sCHT16FA56', 'qY6TEqYnmK', 'pGcTbYxUkK', 'lsiTjmvvXt', 'PWHTnkXG5Y', 'aKbTxToV0D', 'bF8TVO1r8B', 'NQZTqOJ0Br', 'pZiTLWaotn', 'E90TaFB3bP'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, BUANBPjKABgFDh7hbJ.cs	High entropy of concatenated method names: 'BAEuk8McdZ', 'l9rudYcI30', 'ToString', 'o3Hu5Xd5VC', 'tcYuTbcfCj', 'mdEuC0qV83', 'kWXuRssVSy', 'X6yucdjPmE', 'FcQui8hO5i', 'KNCuMcU7FL'
Source: 0.2.SWIFT.exe.4f7fa30.6.raw.unpack, as7UGTTrgSge76n5y2.cs	High entropy of concatenated method names: 'Dispose', 'iiyQLexZb8', 'elLGeFcgJs', 'RVissELPgg', 'emYQa4pkiD', 'WX0QzkyNCu', 'ProcessDialogKey', 'FiqGUE8gUV', 'RpnGQ26BaB', 'je1GGvUMQe'
Source: 0.2.SWIFT.exe.5af0000.12.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.SWIFT.exe.5af0000.12.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'

Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SWIFT.exe PID: 1960, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 1970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 3300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 5300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 6500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 7500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 7630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 8630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 8D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: 9D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: AD10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Memory allocated: BD10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 3250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 5250000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1547			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 8273			Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe TID: 1352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1680	Thread sleep count: 1547 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -99782s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1680	Thread sleep count: 8273 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -99657s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -98694s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -98579s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -98454s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -98329s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -98204s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -98066s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -97954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -97844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -97719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -95860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -95610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -95485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -94985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -94860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -94735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -94610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -94485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -94360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -94235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -94110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1988	Thread sleep time: -93985s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SWIFT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98694	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98066	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93985	Jump to behavior

Source: MSBuild.exe, 00000003.00000002.3248886205.00000000065B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SWIFT.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe	Queries volume information: C:\Users\user\Desktop\SWIFT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.SWIFT.exe.5098988.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.505df68.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.5098988.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.505df68.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3245436957.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3245436957.000000000329E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3245436957.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT.exe PID: 1960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5796, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.SWIFT.exe.4309970.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.5af0000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.5af0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.4309970.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036561499.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2034008651.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.SWIFT.exe.5098988.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.505df68.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.5098988.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.505df68.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3245436957.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT.exe PID: 1960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5796, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.SWIFT.exe.5098988.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.505df68.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.5098988.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.505df68.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3245436957.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3245436957.000000000329E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3245436957.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT.exe PID: 1960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5796, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.SWIFT.exe.4309970.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.5af0000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.5af0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SWIFT.exe.4309970.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2036561499.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2034008651.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SWIFT.exe	53%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
SWIFT.exe	54%	Virustotal		Browse
SWIFT.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
mail92152.maychuemail.com	1%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
mail.quoctoan.vn	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://mail92152.maychuemail.com	0%	Avira URL Cloud	safe
http://mail.quoctoan.vn	0%	Avira URL Cloud	safe
http://mail.quoctoan.vn	0%	Virustotal		Browse
http://mail92152.maychuemail.com	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
mail92152.maychuemail.com	112.213.92.152	true	true	1%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
mail.quoctoan.vn	unknown	unknown	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.quoctoan.vn	MSBuild.exe, 00000003.00000002.3245436957.00000000032A6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://mail92152.maychuemail.com	MSBuild.exe, 00000003.00000002.3245436957.00000000032A6000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	SWIFT.exe, 00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
112.213.92.152	mail92152.maychuemail.com	Viet Nam		45544	SUPERDATA-AS-VNSUPERDATA-VN	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431498
Start date and time:	2024-04-25 10:37:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SWIFT.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@5/1@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 74 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 40.68.123.157, 199.232.210.172, 192.229.211.108, 20.166.126.56, 199.232.214.172
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:37:53	API Interceptor	2x Sleep call for process: SWIFT.exe modified
10:37:54	API Interceptor	90x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
112.213.92.152	5BLllRSrXNY7G7d.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail92152.maychuemail.com	5BLllRSrXNY7G7d.exe	Get hash	malicious	AgentTesla	Browse	112.213.92.152
fp2e7a.wpc.phicdn.net	https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://survey-smiles.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	192.229.211.108
	http://rfpteams.ksplastlc.net	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://app.milanote.com/1RZbnl1zfBXuaf?p=r2B66sphbV4	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://decktop.us/gORiyf	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://cos-aliyun8789.towqzg.cn/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://shining-melodic-magnesium.glitch.me/rvicendDev.html	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://univ-paris13-4.laviewddns.com/login.php?wa=wsignin1.0&client_id=fe9c55ad-8a94-46b2-a3c3-816799478139	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://univ-paris13-3.laviewddns.com/login.php?wa=wsignin1.0&client_id=fe9c55ad-8a94-46b2-a3c3-816799478139	Get hash	malicious	Unknown	Browse	192.229.211.108
bg.microsoft.map.fastly.net	https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse	199.232.214.172
	page97.exe	Get hash	malicious	LonePage	Browse	199.232.210.172
	Minutes_of_15th_Session_of_PSC.pdf.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	KMj8h32vWy.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.214.172
	https://cos-aliyun8789.towqzg.cn/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://shining-melodic-magnesium.glitch.me/rvicendDev.html	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://univ-paris13-4.laviewddns.com/login.php?wa=wsignin1.0&client_id=fe9c55ad-8a94-46b2-a3c3-816799478139	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://univ-paris13.laviewddns.com/login.php?wa=wsignin1.0&client_id=fe9c55ad-8a94-46b2-a3c3-816799478139	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://fassouyatajadalravuij.blob.core.windows.net/fassouyatajadalravuij/1.html?KIUS8wH0YY7cB2NMwxGsVoa5iezV7W9cvLqamEPM8HdxqBLgYyX6Goh6aNwgjitRkRWLcAfZPzQwfAIRlIAPQ3jfogxjD1t9nA60#cl/26081_md/7/18507/5419/19036/1614238	Get hash	malicious	Phisher	Browse	199.232.210.172
	https://windowdefalerts-error0x21702-alert-virus-detected.pages.dev/	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SUPERDATA-AS-VNSUPERDATA-VN	5BLllRSrXNY7G7d.exe	Get hash	malicious	AgentTesla	Browse	112.213.92.152
	rMayNewPurchase.exe	Get hash	malicious	AgentTesla	Browse	112.213.93.72
	rRECEIPTTRANSFE.exe	Get hash	malicious	AgentTesla	Browse	112.213.93.72
	SecuriteInfo.com.Win32.PWSX-gen.11821.9568.exe	Get hash	malicious	AgentTesla	Browse	112.213.90.70
	Transferencia 78897645.exe	Get hash	malicious	Unknown	Browse	103.77.162.8
	Transferencia 78897645.exe	Get hash	malicious	Unknown	Browse	103.77.162.8
	pago 78890943.exe	Get hash	malicious	Unknown	Browse	103.77.162.8
	pago 78890943.exe	Get hash	malicious	Unknown	Browse	103.77.162.8
	Confirmaci#U00f3n de factura.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.77.162.8
	pago 89909334.exe	Get hash	malicious	Unknown	Browse	103.77.162.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://rfpteams.ksplastlc.net	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://shining-melodic-magnesium.glitch.me/rvicendDev.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://ernestjcrist.icu/23d80j2d/qwd13d8jqd/index.html?13813e8=0101%2020596-12595&13813e8=https://femininplurielles.com	Get hash	malicious	TechSupportScam	Browse	23.1.237.91
	https://jiujiuwanka.cn/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://goxdgdb.cn/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://clicks.aweber.com/y/ct/?l=irQzWw&m=hE2OWd5T.UYPuTr&b=hqint4ojZ0QPjD7.f4mxDg#Ym5hbmRlcnNvbkBwcmVzaWRpby5jb20=	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://gamma.app/docs/Shared-Document-9j9g6z8iqo1w0uu	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://cloudflare-ipfs.com/ipfs/bafkreiffz46tyqvifmyhjcdbynucd4duurmznmxaorlfjuwzovmtocshje	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://phoenixdevcom.glastec.org/?nLN3=brX8q	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91

Process:	C:\Users\user\Desktop\SWIFT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.979239549999064
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SWIFT.exe
File size:	687'616 bytes
MD5:	c3783358a70c67db7ba565a68872b2d6
SHA1:	e0c97fdd090069d6fb47589643fad0d8365b537a
SHA256:	2e546d749c2e13895babd1d2bca41978605c1ba3967ca0b21709646120704760
SHA512:	1290fdf7c8ea57681cc62d27d32f6a2b9b386350cdf883d81f931b01cb19c1a9f38487d58d6f96900406e8dbb2cd0fafb0038e9fd2c003b3dce1c3b5ea1ce229
SSDEEP:	12288:Ztlv312Z3YYmvBh+a/UOqfGFE4xyqJaUpzWDAMk3dWlajbrYbCCZM:ZtJ312ZY1v7PxqfYEkvzlMk3AirYmCZ
TLSH:	DCE423A75DD11B19D07D67BF1EA245347370708AC413F34D9AA887D2428BB0F6AD2E2B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..r..........^.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4a915e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF3EC99AE [Sun Sep 6 09:15:26 2099 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
inc esi
dec edi
push edx
xor al, 54h
xor eax, 42384738h
aaa
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], dh
cmp byte ptr [ecx+50h], dl
xor eax, 36374734h
pop edx
inc ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa910a	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x61c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa7d40	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa7184	0xa7200	db060e3c33533985d744cf4abcc978e3	False	0.977636207460733	data	7.9848971240460545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x61c	0x800	d50f0ff92c5276d84a5f70ce74ff17e0	False	0.33642578125	data	3.4700575050860465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	772d63d3cdb26c0ae5becba22a6ae728	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xaa090	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data			0.41740088105726875
RT_MANIFEST	0xaa42c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-10:38:01.777560	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49704	587	192.168.2.5	112.213.92.152
04/25/24-10:38:01.777589	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49704	587	192.168.2.5	112.213.92.152
04/25/24-10:38:01.777589	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49704	587	192.168.2.5	112.213.92.152
04/25/24-10:38:01.777589	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49704	587	192.168.2.5	112.213.92.152
04/25/24-10:38:01.777589	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49704	587	192.168.2.5	112.213.92.152
04/25/24-10:38:01.777560	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49704	587	192.168.2.5	112.213.92.152

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 10:37:52.545182943 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:37:52.545193911 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:37:52.654571056 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:37:57.381022930 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:37:57.736526966 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:37:57.736675024 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:37:58.387259007 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:37:58.388271093 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:37:58.741028070 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:37:58.742093086 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:37:59.095443964 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:37:59.096844912 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:37:59.490789890 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:37:59.532633066 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:37:59.532957077 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:37:59.892577887 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:37:59.944677114 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:37:59.944936991 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:38:00.300678015 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:38:01.415672064 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:38:01.415936947 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:38:01.776833057 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:38:01.776878119 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:38:01.777559996 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:38:01.777589083 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:38:01.777611971 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:38:01.777635098 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:38:02.147495985 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:38:02.154479980 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:02.154623985 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:02.187846899 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:38:02.264013052 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:03.639888048 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 10:38:03.640022039 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:07.247893095 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:38:07.295137882 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:38:14.145287037 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:14.145399094 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:14.156886101 CEST	49710	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:14.156930923 CEST	443	49710	23.1.237.91	192.168.2.5
Apr 25, 2024 10:38:14.156996965 CEST	49710	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:14.163110971 CEST	49710	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:14.163132906 CEST	443	49710	23.1.237.91	192.168.2.5
Apr 25, 2024 10:38:14.302949905 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 10:38:14.302977085 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 10:38:14.493361950 CEST	443	49710	23.1.237.91	192.168.2.5
Apr 25, 2024 10:38:14.493434906 CEST	49710	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:38:33.645051956 CEST	443	49710	23.1.237.91	192.168.2.5
Apr 25, 2024 10:38:33.645250082 CEST	49710	443	192.168.2.5	23.1.237.91
Apr 25, 2024 10:39:36.185545921 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:39:36.589833021 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:39:36.750041008 CEST	587	49704	112.213.92.152	192.168.2.5
Apr 25, 2024 10:39:36.750166893 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:39:36.750278950 CEST	49704	587	192.168.2.5	112.213.92.152
Apr 25, 2024 10:39:37.106718063 CEST	587	49704	112.213.92.152	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 10:37:56.144443035 CEST	56939	53	192.168.2.5	1.1.1.1
Apr 25, 2024 10:37:57.139168024 CEST	56939	53	192.168.2.5	1.1.1.1
Apr 25, 2024 10:37:57.373195887 CEST	53	56939	1.1.1.1	192.168.2.5
Apr 25, 2024 10:37:57.373274088 CEST	53	56939	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 10:37:56.144443035 CEST	192.168.2.5	1.1.1.1	0x8c07	Standard query (0)	mail.quoctoan.vn	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:37:57.139168024 CEST	192.168.2.5	1.1.1.1	0x8c07	Standard query (0)	mail.quoctoan.vn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 10:37:57.373195887 CEST	1.1.1.1	192.168.2.5	0x8c07	No error (0)	mail.quoctoan.vn	mail92152.maychuemail.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 10:37:57.373195887 CEST	1.1.1.1	192.168.2.5	0x8c07	No error (0)	mail92152.maychuemail.com		112.213.92.152	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:37:57.373274088 CEST	1.1.1.1	192.168.2.5	0x8c07	No error (0)	mail.quoctoan.vn	mail92152.maychuemail.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 10:37:57.373274088 CEST	1.1.1.1	192.168.2.5	0x8c07	No error (0)	mail92152.maychuemail.com		112.213.92.152	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:13.824147940 CEST	1.1.1.1	192.168.2.5	0x916b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:13.824147940 CEST	1.1.1.1	192.168.2.5	0x916b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:13.830079079 CEST	1.1.1.1	192.168.2.5	0xbab	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 10:38:13.830079079 CEST	1.1.1.1	192.168.2.5	0xbab	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:38:27.289800882 CEST	1.1.1.1	192.168.2.5	0xc1d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 10:38:27.289800882 CEST	1.1.1.1	192.168.2.5	0xc1d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:39:14.494929075 CEST	1.1.1.1	192.168.2.5	0x50b9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 10:39:14.494929075 CEST	1.1.1.1	192.168.2.5	0x50b9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 25, 2024 10:37:58.387259007 CEST	587	49704	112.213.92.152	192.168.2.5	220-mail92152.maychuemail.com ESMTP Mail Security System 220- We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 25, 2024 10:37:58.388271093 CEST	49704	587	192.168.2.5	112.213.92.152	EHLO 965969
Apr 25, 2024 10:37:58.741028070 CEST	587	49704	112.213.92.152	192.168.2.5	250-mail92152.maychuemail.com Hello 965969 [185.152.66.230] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250-SMTPUTF8 250 HELP
Apr 25, 2024 10:37:58.742093086 CEST	49704	587	192.168.2.5	112.213.92.152	AUTH login bG9uZ194bmtAcXVvY3RvYW4udm4=
Apr 25, 2024 10:37:59.095443964 CEST	587	49704	112.213.92.152	192.168.2.5	334 UGFzc3dvcmQ6
Apr 25, 2024 10:37:59.532633066 CEST	587	49704	112.213.92.152	192.168.2.5	235 Authentication succeeded
Apr 25, 2024 10:37:59.532957077 CEST	49704	587	192.168.2.5	112.213.92.152	MAIL FROM:<long_xnk@quoctoan.vn>
Apr 25, 2024 10:37:59.944677114 CEST	587	49704	112.213.92.152	192.168.2.5	250 OK
Apr 25, 2024 10:37:59.944936991 CEST	49704	587	192.168.2.5	112.213.92.152	RCPT TO:<dclarkson007@protonmail.com>
Apr 25, 2024 10:38:01.415672064 CEST	587	49704	112.213.92.152	192.168.2.5	250 Accepted
Apr 25, 2024 10:38:01.415936947 CEST	49704	587	192.168.2.5	112.213.92.152	DATA
Apr 25, 2024 10:38:01.776878119 CEST	587	49704	112.213.92.152	192.168.2.5	354 Enter message, ending with "." on a line by itself
Apr 25, 2024 10:38:01.777635098 CEST	49704	587	192.168.2.5	112.213.92.152	.
Apr 25, 2024 10:38:07.247893095 CEST	587	49704	112.213.92.152	192.168.2.5	250 OK id=1rzucA-00000005UV7-0cpf
Apr 25, 2024 10:39:36.185545921 CEST	49704	587	192.168.2.5	112.213.92.152	QUIT
Apr 25, 2024 10:39:36.750041008 CEST	587	49704	112.213.92.152	192.168.2.5	221 mail92152.maychuemail.com closing connection

Target ID:	0
Start time:	10:37:52
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\SWIFT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT.exe"
Imagebase:	0xf80000
File size:	687'616 bytes
MD5 hash:	C3783358A70C67DB7BA565A68872B2D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2036561499.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2034008651.0000000004309000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2034008651.000000000505D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:37:53
Start date:	25/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x300000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:37:53
Start date:	25/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xf90000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3245436957.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3244352148.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3245436957.000000000329E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3245436957.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3245436957.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	99
Total number of Limit Nodes:	4

Executed Functions

Function 058BDCC8 Relevance: 8.5, Strings: 6, Instructions: 1042
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xb`q, xrefs: 058BDDF8
TJbq, xrefs: 058BDE6D
Te]q, xrefs: 058BE522
4']q, xrefs: 058BE8C9
paq, xrefs: 058BE9A1
&IH3, xrefs: 058BE0C0

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID: &IH3$4']q$TJbq$Te]q$paq$xb`q
API String ID: 0-2481757060
Opcode ID: 9f41c42a90a8b3112ec81b3550bdfb3f3517dececa48078c4246372d7964cd3b
Instruction ID: 829bb08ed63dd28f4b1a8376b27938fcb81aac6a456c372adbf3636691a4d138
Opcode Fuzzy Hash: 9f41c42a90a8b3112ec81b3550bdfb3f3517dececa48078c4246372d7964cd3b
Instruction Fuzzy Hash: 8CB2C274A00628CFDB65CF69C984AD9BBB6FF89304F1581E9D509AB325DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 058B6BE8 Relevance: .9, Instructions: 924COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6cf7477a58d6d6f3409d710de5dc5946cafaeba15b5bd8d8a98d6b96844f90
Instruction ID: 24858fea15577d7f5f92ac86cf0d4449c9cf4e5feb93e1ce879eec24dc787c5c
Opcode Fuzzy Hash: 0d6cf7477a58d6d6f3409d710de5dc5946cafaeba15b5bd8d8a98d6b96844f90
Instruction Fuzzy Hash: 8DA2F374A012198FDB14DF68C994AD9B7B2FF99300F5082E9D949AB360DB70AEC5CF41

Uniqueness

Uniqueness Score: -1.00%

Function 058B6BD8 Relevance: .8, Instructions: 850COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730b98026e616a629db70cb4b5796373a9397a0374214421c33ec9cf7f7a8e44
Instruction ID: 88797973fb2a7de3c6c7873eec7d44521898a4b892edfbb5cafb71dcf1dc8d19
Opcode Fuzzy Hash: 730b98026e616a629db70cb4b5796373a9397a0374214421c33ec9cf7f7a8e44
Instruction Fuzzy Hash: E592F374A012198FDB14DF68C894AD9B7B2FF99300F5082E9D949AB360DB70AEC5CF41

Uniqueness

Uniqueness Score: -1.00%

Function 08A60C90 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037818471.0000000008A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a60000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65af076b063fdfff380467f7bf02b670aae7df8d5641ad836ef597822047e39c
Instruction ID: 44e5258596743a355b832d8b35b6bd5ab0e135fccdd78118b27b2cfb7ec6f86c
Opcode Fuzzy Hash: 65af076b063fdfff380467f7bf02b670aae7df8d5641ad836ef597822047e39c
Instruction Fuzzy Hash: A2D1AB30B00A018FDB15EB79C550B6EB7FAAFC8612F14446DD10AEBA94DB39E841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 058BD2F8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22bfb8225ae0eda5275a9c72950827a63f8b8c5ee992a120f70e3416d6d3567
Instruction ID: c4732ac8ac41e4b7495680b9e4161af6646fae03411bdb9f8b5eff74fd6ea296
Opcode Fuzzy Hash: c22bfb8225ae0eda5275a9c72950827a63f8b8c5ee992a120f70e3416d6d3567
Instruction Fuzzy Hash: 9A11DE71D056188BE718CFABC9052DDBAF7AFC8300F04C03AD919AB658EB7409468B50

Uniqueness

Uniqueness Score: -1.00%

Function 0197ADA8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0197AFFE

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1584647977491a857bac06b331bdeb19c0a3d8c2101ae51a237a640e7e1336d4
Instruction ID: a2471fb9a98effc33810f32a60599ee0cd851991faad0f4a142e5ff158494e3d
Opcode Fuzzy Hash: 1584647977491a857bac06b331bdeb19c0a3d8c2101ae51a237a640e7e1336d4
Instruction Fuzzy Hash: CA715470A00B058FE724DF2AD44479ABBF5FF88301F048A2DD49AD7A50DB35E949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 019744B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 019759C9

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bd5a10dbf012515ad5e838fcc7921320d7b021338c0d8d83cc0d1dbda59b9672
Instruction ID: 17ee3d0aa7487a5e4ae1c277d83b613c43e44878563938ab2b05ddd63e0b6a2e
Opcode Fuzzy Hash: bd5a10dbf012515ad5e838fcc7921320d7b021338c0d8d83cc0d1dbda59b9672
Instruction Fuzzy Hash: 9941E2B0C0071DCBDB24DFAAC984B9DBBF5BF49304F60806AD408AB255DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0197590C Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 019759C9

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cac34ba5b575fde0e782351cdd73f2344853ccc83c2afcbe196a17a879471eab
Instruction ID: 60cef8ca831878ce27e2acb0d35a2d303beeadc6ef3dc0d820b1559d9a0e48cd
Opcode Fuzzy Hash: cac34ba5b575fde0e782351cdd73f2344853ccc83c2afcbe196a17a879471eab
Instruction Fuzzy Hash: 8441E2B0C00719CADB24DFAAC984BDDBBF5BF49304F20816AD418AB255DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 058B4040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 058B4101

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3b86e09d9a89754b3aa72e21d9f90b0c9c95021eb663984b178ac9aa5e173122
Instruction ID: d627885762c191369b4e1d50f92979654f0d8ac3486b41380cd688aa72b221b0
Opcode Fuzzy Hash: 3b86e09d9a89754b3aa72e21d9f90b0c9c95021eb663984b178ac9aa5e173122
Instruction Fuzzy Hash: C14129B4900309CFDB14DF99C449AAABBFAFB89314F248459D919A7321D374A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0197D27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0197D656,?,?,?,?,?), ref: 0197D717

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 184d97d222fdbd63b3f188b3f3888b8151904575a77c1980d4224fb0cf2a8d55
Instruction ID: db18b2e4d499a498c684a90ef0634e920f61c2639ca479033bc439e7c225966d
Opcode Fuzzy Hash: 184d97d222fdbd63b3f188b3f3888b8151904575a77c1980d4224fb0cf2a8d55
Instruction Fuzzy Hash: 4921E3B59002489FDB10CFAAD584AEEFFF9EF48310F14841AE918A7310D378A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0197D689 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0197D656,?,?,?,?,?), ref: 0197D717

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 88586f421893eed7e01e9b5d037932f02168ebc86af55d3b052e9c2399494f7b
Instruction ID: d6a9c20d52bf2da818607f72936d69d4ccf78caab2c9e67b8d09b792033ec65b
Opcode Fuzzy Hash: 88586f421893eed7e01e9b5d037932f02168ebc86af55d3b052e9c2399494f7b
Instruction Fuzzy Hash: 7F21B3B59002499FDB10CFA9D585AEEFBF5FF48314F14841AE918A3250D378A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0197A130 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0197B079,00000800,00000000,00000000), ref: 0197B28A

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3bd806924d290ba47b5ccde40e428787075e8248c5179e94cc63f191e256980f
Instruction ID: ec22bc327ea7e5c2e3d4242a7834274bddd14a03e01a3e12490d357456105e26
Opcode Fuzzy Hash: 3bd806924d290ba47b5ccde40e428787075e8248c5179e94cc63f191e256980f
Instruction Fuzzy Hash: 7B1126B69003088FDB10CF9AD448BEEFBF8EF58310F10842AD919A7210C379A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0197B219 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0197B079,00000800,00000000,00000000), ref: 0197B28A

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 80c5c3b75a90b03bf74ce069bf94edb8c52ce4eae58f2ff1c3283301b3753ef4
Instruction ID: 0a0ba1ad537929e15c81eec0d81082d86cace0f091dbaf8f6d8be04f1af8c247
Opcode Fuzzy Hash: 80c5c3b75a90b03bf74ce069bf94edb8c52ce4eae58f2ff1c3283301b3753ef4
Instruction Fuzzy Hash: 181112B68003488FDB10CFAAD848B9EFBF8EF48310F10842AD919A7210C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08A60C34 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,08A61C19,?,?), ref: 08A61DC0

Memory Dump Source

Source File: 00000000.00000002.2037818471.0000000008A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a60000_SWIFT.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7354462bad37a670fb8620cc60352d4930be1bb299674ed6012feb0bf975fbd6
Instruction ID: 1769abea3d25589472164432676de535ef898d6d625f3aee8616fb4e15cb6793
Opcode Fuzzy Hash: 7354462bad37a670fb8620cc60352d4930be1bb299674ed6012feb0bf975fbd6
Instruction Fuzzy Hash: 301125B1800349CFCB20DF9AC545BEEBBF4EB49320F108819D958A7640D738A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08A61D60 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,08A61C19,?,?), ref: 08A61DC0

Memory Dump Source

Source File: 00000000.00000002.2037818471.0000000008A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a60000_SWIFT.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1a0356633aa1ef79cb24d5303541ad104c56d41912d7ef1bb610d842560b3b43
Instruction ID: 62b353b00c19abeded6dddea41a7746f7c4e7fc946fd4adc74abd3fbaded823e
Opcode Fuzzy Hash: 1a0356633aa1ef79cb24d5303541ad104c56d41912d7ef1bb610d842560b3b43
Instruction Fuzzy Hash: 001125B58006498FCB20DFAAD545BEEBFF4EB48320F208819D558A7650D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0197AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0197AFFE

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 567b402e2540d87a49c4b817ccda50e65b038ca055af2201a002e11dd9b0b039
Instruction ID: 15b8d624b0aed1248048976b664b4c2ed0c30d069f7fc35b7bf17854549ca940
Opcode Fuzzy Hash: 567b402e2540d87a49c4b817ccda50e65b038ca055af2201a002e11dd9b0b039
Instruction Fuzzy Hash: DF1110B5C003498FDB10CF9AC444ADEFBF8EF88314F10842AD529A7210D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0191D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032609126.000000000191D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0191D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_191d000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe9b191e5b3a3d4da2b84d8ea85293d688b82e409c12646b594ae75cb0c2a9d
Instruction ID: 7db8f4cbbd0967b1ed2f5e6fadda333d15183c1d33fbc88bc82b1040da6a4f8e
Opcode Fuzzy Hash: ffe9b191e5b3a3d4da2b84d8ea85293d688b82e409c12646b594ae75cb0c2a9d
Instruction Fuzzy Hash: CA212771140208DFDB05DF54D9C4F56BFA9FB88714F20C569D90D0B29AC33AE486C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0192D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032665460.000000000192D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0192D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_192d000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91dafda37257fca8817612610c8fcb8f38de922a33fe9e12750327fd66140456
Instruction ID: f33e75d5d04504fa9d29d647788ffe59594ec17e4882cbc86b6d26b0899ce4e0
Opcode Fuzzy Hash: 91dafda37257fca8817612610c8fcb8f38de922a33fe9e12750327fd66140456
Instruction Fuzzy Hash: A8210771504204DFDB05DF98D5C0F26BBA9FB85324F20C96DD90D4B25AC33AD406CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0192D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032665460.000000000192D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0192D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_192d000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b063863b70b754d7e6039db54a5d926d74ba985b19a7648db69284972eaf475
Instruction ID: eafc5501b444e5b4b368f7d4fff45d9a2e4a70133b7a44eb25e484a42db078f1
Opcode Fuzzy Hash: 4b063863b70b754d7e6039db54a5d926d74ba985b19a7648db69284972eaf475
Instruction Fuzzy Hash: 11210371584240DFDB15DF68D580F26BFA9EB84314F20C969D90D0B26AC33ED406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0192D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032665460.000000000192D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0192D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_192d000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88f8afb25f677365eb45f89546ed7cee8e90eb0124f103fbceb5c5aee87d7ab
Instruction ID: e0bc834082bbfdc00e9cdc6a1c8f031976774fa82353b54eea1613cb77e860af
Opcode Fuzzy Hash: b88f8afb25f677365eb45f89546ed7cee8e90eb0124f103fbceb5c5aee87d7ab
Instruction Fuzzy Hash: 26219F755493808FDB13CF24D994715BFB1EB46214F28C5EAD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0191D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032609126.000000000191D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0191D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_191d000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: b2942cc1c5f79c6832d2079352b2c4669e7fec20b13bc49723ce4c72eda7c56d
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 3E112972444244CFDB16CF44D5C4B56BFB1FB84314F24C6A9D9090B29BC33AD456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0192D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032665460.000000000192D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0192D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_192d000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 999536cfe1613a39dc0fedb7889d9f3852b805345ccbce775490f8d1c324abde
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 5911BB75504280DFDB02CF54C5C4B15BFA1FB85224F24C6A9D8494B29AC33AD40ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0191D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032609126.000000000191D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0191D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_191d000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af824aae57763bb3f939c186401cdd9e65db25de66a52bb85a33d6c0f227615
Instruction ID: f42adeeae857541a75ac70aeb1fbb71eb87afa13d0c470da461de932c5d9342f
Opcode Fuzzy Hash: 7af824aae57763bb3f939c186401cdd9e65db25de66a52bb85a33d6c0f227615
Instruction Fuzzy Hash: 6E01FCB10043889AE7105A99CD8CB67BFDCDF45361F18C929ED0C0A24AD2799481CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0191D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032609126.000000000191D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0191D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_191d000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9aec9a4279cf7ddd966850fbefef0aff7bb810a1277cb560eced306eff3adb
Instruction ID: 0938ccade2b6c83f97447f7c197ac290bf6589f2aacd39c0968dc6d593e0719c
Opcode Fuzzy Hash: 7c9aec9a4279cf7ddd966850fbefef0aff7bb810a1277cb560eced306eff3adb
Instruction Fuzzy Hash: 08F0C2B10043849AE7118E5AC888B62FFECEF45235F18C45AED4C0B28AC2799880CAB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 058BDCB7 Relevance: 4.0, Strings: 3, Instructions: 272COMMON

Download Yara Rule

Strings

xb`q, xrefs: 058BDDF8
TJbq, xrefs: 058BDE6D
Te]q, xrefs: 058BE522

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$xb`q
API String ID: 0-1930611328
Opcode ID: 04ae426ca852d4444579243d8209d6994b51157f61c546ec72f2e7a79e6c372f
Instruction ID: cd10c491b93dc17f74324df7cb9e74b6a4fa375c4c1baf0c51ad585861e92250
Opcode Fuzzy Hash: 04ae426ca852d4444579243d8209d6994b51157f61c546ec72f2e7a79e6c372f
Instruction Fuzzy Hash: 73D18575E016188FDB58CF6AD9546D9BBF6BFC8300F14C1AAD808AB324DB309E858F50

Uniqueness

Uniqueness Score: -1.00%

Function 058BDA20 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

4']q, xrefs: 058BDB01

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 9ffd6aacf56d67d55184dfd63e45ee6e1edd7a669aac4479df76e5c4b09cc05e
Instruction ID: ab7fe5fc146c91215580d5ba6f8b420f884f03adc503b4c9b569684f34307bcc
Opcode Fuzzy Hash: 9ffd6aacf56d67d55184dfd63e45ee6e1edd7a669aac4479df76e5c4b09cc05e
Instruction Fuzzy Hash: 386101B0A102098FD748DF6AE9516AABFF6FFC8300F14D526D50497268DB78A945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 058BDA30 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

4']q, xrefs: 058BDB01

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: b66d0d5fe6024d6aa6cde55fdd4b5b61f7028b225d1bc14ad372c721607e8f66
Instruction ID: f7f49694ecdcf3c16f0128888b825272c7b0ddafcdd8c068be8a381d475fe3c4
Opcode Fuzzy Hash: b66d0d5fe6024d6aa6cde55fdd4b5b61f7028b225d1bc14ad372c721607e8f66
Instruction Fuzzy Hash: A761F2709102098FD748DF6AE9516AABFF6FFC8300F14D52AD50497264EF78A945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 058B0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951aebec55f299d9919e5fff3de19f0c34138e52c87ca2b2f3d4187be1e8ad65
Instruction ID: 441d86ce5f806cd7883b38817fa9a0c04957434084886cb723d5c226c87f6a52
Opcode Fuzzy Hash: 951aebec55f299d9919e5fff3de19f0c34138e52c87ca2b2f3d4187be1e8ad65
Instruction Fuzzy Hash: CC12A2B1A097459AF330CF65E84C1893AB1BF85328BD24309D2656A6EDDBB8154FCFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0197D5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032902694.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb8dd94dc4674e4367a8eb2cd3df984cfc22f0ab5828e1e2833bd7e68bff579
Instruction ID: dec490504dc5d2844b2d55d5ba5d666d991a6d5d3215fe24936962d5d9958a1a
Opcode Fuzzy Hash: 5cb8dd94dc4674e4367a8eb2cd3df984cfc22f0ab5828e1e2833bd7e68bff579
Instruction Fuzzy Hash: 90A18E32E0020A8FCF15DFB4D8449DEBBB6FF85301B15456AE91ABB265DB31E915CB80

Uniqueness

Uniqueness Score: -1.00%

Function 058B0006 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2036379619.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SWIFT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd8c541d25c410e6722c4916a5f71fe12383032f2e7fef7b4105595344aa4cf5
Instruction ID: 48870a6edfee5ae0b81722bc12c9f426fd11f6e16bc8dd183e131507e52d4e30
Opcode Fuzzy Hash: fd8c541d25c410e6722c4916a5f71fe12383032f2e7fef7b4105595344aa4cf5
Instruction Fuzzy Hash: 23C109B0A087459BE721CF24E8481897BB1BF85328F924309D2616B2EDDBB4154FCFC4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 5796, Parent PID: 1960COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 030A9B30 Relevance: 2.9, Instructions: 2897COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc417e127e66d0261ab007c7e4e87be484599614825342ebf9111772bd839fc3
Instruction ID: 440dbabb4314e7bb09c7849820877374a29e7188ad53851e160499a640bb4c5c
Opcode Fuzzy Hash: bc417e127e66d0261ab007c7e4e87be484599614825342ebf9111772bd839fc3
Instruction Fuzzy Hash: 9E63F931D10B1A8ADB51EB68C8405A9F7B1FF99300F15C79AE458BB121EB70AAD5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 030ACE78 Relevance: 2.3, Instructions: 2312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d496b5acaf0f0dadca4f86383158c1743e1f492b05e65f519a5be4edc03c57a3
Instruction ID: 2d336bc29d9042d95f99504535b9242da065d558400c7868233219c15070107c
Opcode Fuzzy Hash: d496b5acaf0f0dadca4f86383158c1743e1f492b05e65f519a5be4edc03c57a3
Instruction Fuzzy Hash: 90332E31D10B198EDB11EFA8C8906ADF7B5FF99300F15C79AD458A7211EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030A3E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 030A40CB

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: d7c28e26d3ff92687cebfcfc60fc83edb0a07e24c31340e21f9c5dcf68195370
Instruction ID: c7e2498cf0eedfa0d16898e1e5853931202f26e4ec8d3316e5b3b602be77e81e
Opcode Fuzzy Hash: d7c28e26d3ff92687cebfcfc60fc83edb0a07e24c31340e21f9c5dcf68195370
Instruction Fuzzy Hash: EE915A74E116099FDF50CFAED98179EBBF2AF88304F188129E419AB354EB749845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030A9380 Relevance: .6, Instructions: 610COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23c2fc9210821d17d92a1d306a3bcc09f97d0ac2212d42d0db06e6a70cf35cf
Instruction ID: 28a23921213b30d72e02e7df6b5b0b6631d5f0984f342fe571c20a7db16ece17
Opcode Fuzzy Hash: d23c2fc9210821d17d92a1d306a3bcc09f97d0ac2212d42d0db06e6a70cf35cf
Instruction Fuzzy Hash: 9A226C35B016098FDB54DFA8E984AADBBF6EF88310F148569E809DB394DB34DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030A4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0994e99d968197b12c89c1225232bbe1d1ac9117210902e13ce290d7190d94e
Instruction ID: b4403f0d606858c50fce06c754a8b1ca4e7b75b981e0e71e2f03350094540f50
Opcode Fuzzy Hash: f0994e99d968197b12c89c1225232bbe1d1ac9117210902e13ce290d7190d94e
Instruction Fuzzy Hash: ECB16E74E116098FDB50CFEED88179DFBF2AF88314F188529D419AB354EBB49845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030A4805 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 030A487F
\Vl, xrefs: 030A49D2

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: f5d81b7808db5ef108b255bcd7a1209574f8a87dc854522d67b77888554a4e3b
Instruction ID: 5af50f9eb961946b40cd7f05a5eb44c9a2a8b04875de3e4d5e9a68ab5ccdb02c
Opcode Fuzzy Hash: f5d81b7808db5ef108b255bcd7a1209574f8a87dc854522d67b77888554a4e3b
Instruction Fuzzy Hash: 5E717A74D05649DFDB10CFEEE88179EBBF1AF88304F188129E418AB354EBB49841CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030A4810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 030A487F
\Vl, xrefs: 030A49D2

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 1fa215d11c5f612720ac7e93750c709335b7c619808a875a2df9429ae775983d
Instruction ID: fd9f00d3c70664c17baf98a18517edb18293bad2f559043fc6851ec92c87e802
Opcode Fuzzy Hash: 1fa215d11c5f612720ac7e93750c709335b7c619808a875a2df9429ae775983d
Instruction Fuzzy Hash: 75717C74E056099FDB10CFEEE88179DBBF2AF88314F188129E414AB354EBB49841CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030A6EDF Relevance: 2.6, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 030A6F16
LR]q, xrefs: 030A6FED

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: edba6d3e57640c722ea8cf4b57e4e9cd9ab5042ddb1bf50187d4f798d09ee370
Instruction ID: 05ec37cb1eecac781505ed51f69c332b721c0fae083363118d1897d75f6f2e6c
Opcode Fuzzy Hash: edba6d3e57640c722ea8cf4b57e4e9cd9ab5042ddb1bf50187d4f798d09ee370
Instruction Fuzzy Hash: DA51D130A01649DFDB15DFB8D854B9EB7B6EF85700F18856AE405EB380DB71D842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067CD574 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(8B5505FB), ref: 067CE2D7

Memory Dump Source

Source File: 00000003.00000002.3249378067.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67c0000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: fa682bd89dc8ec0d7015f73e289461d8a35feb9754a6772efe559229001e71de
Instruction ID: 01f2737e5344359d403d70aac6d2872d376bdfd943dfb313f190f31be82aafd1
Opcode Fuzzy Hash: fa682bd89dc8ec0d7015f73e289461d8a35feb9754a6772efe559229001e71de
Instruction Fuzzy Hash: B511F4B1C0065A9BDB10DF9AC544BAEFBF4AB48320F10816AE518A7240D378A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 067CE268 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(8B5505FB), ref: 067CE2D7

Memory Dump Source

Source File: 00000003.00000002.3249378067.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67c0000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c7b9c624f476ca39b59ca1cc36dfe8fce3c404914bbb325943ff9c12ce4f3ed6
Instruction ID: 7b7c950d60368f0abbe56c56ee86952d268f57ed528138e496eef404255b92b3
Opcode Fuzzy Hash: c7b9c624f476ca39b59ca1cc36dfe8fce3c404914bbb325943ff9c12ce4f3ed6
Instruction Fuzzy Hash: DE1114B1C0065A9BDB10DFAAC5457EEFBF4BF08320F15816AD418B7240D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030A3E74 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

\Vl, xrefs: 030A40CB

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 9cd66b2e8f46ed9ed21a61f372e0ecedef2a2df9db5959b4955438f484e99940
Instruction ID: 08bd19900a740af27e9b3304985fcf6aa2759e26f512a5b0fc01e127411f651d
Opcode Fuzzy Hash: 9cd66b2e8f46ed9ed21a61f372e0ecedef2a2df9db5959b4955438f484e99940
Instruction Fuzzy Hash: 04A14874E016099FDB50CFEEE98179DFBF2AF88314F188129E418AB354EB749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030AF3AD Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PH]q, xrefs: 030AF4FB

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 0b1972f364a6ead7d06dc2f01a1d7bae87956e202de08bfd9bc3f6b78f61fe0b
Instruction ID: 8f2202a79202ab1f912cba88ec7194449d56757d60ddad093cdebf292d30e9cc
Opcode Fuzzy Hash: 0b1972f364a6ead7d06dc2f01a1d7bae87956e202de08bfd9bc3f6b78f61fe0b
Instruction Fuzzy Hash: 8431E130B042028FCB55ABB8E95466E7BF7AF89640F184578D006DB385DF39DC46CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 030AF3C0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 030AF4FB

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 04647c8313614a61b3e56e34383a1ad50795379af484b77d7480f83b862a61ec
Instruction ID: e02433950ed6542e544c23c3435d03e5566f169f956d5dd8f0c9ce36452644d3
Opcode Fuzzy Hash: 04647c8313614a61b3e56e34383a1ad50795379af484b77d7480f83b862a61ec
Instruction Fuzzy Hash: B931E1307042028FCB58ABB8E95466F7BE7AF89640F144578D006DB384DF39DC46C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 030A6F80 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR]q, xrefs: 030A6FED

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 063d49b672b4e7f162395bbc7153fc01bb8d4d0dbc36eb5d172ce278436497bd
Instruction ID: fdcc1b2cc85c1e4fae4748a55b2f210aa9e7421edb12b001ec84a06a88cdfbec
Opcode Fuzzy Hash: 063d49b672b4e7f162395bbc7153fc01bb8d4d0dbc36eb5d172ce278436497bd
Instruction Fuzzy Hash: A2318E30E11609DBDB14CFE8D844B9EB7B6FF85710F24C569E805EB240EBB1E8428B51

Uniqueness

Uniqueness Score: -1.00%

Function 030A7910 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78d3bb0a9dbb3fe18bbebff3d1852ffab57b98df914d0dfc8b0ae1d6392f7d3
Instruction ID: 60a345c8b2d55f76edd8c3eb8c49a91cdc27c9c511d0e3300d09a908f73ad07c
Opcode Fuzzy Hash: b78d3bb0a9dbb3fe18bbebff3d1852ffab57b98df914d0dfc8b0ae1d6392f7d3
Instruction Fuzzy Hash: 65229130710202DFDB19AE7CF894A5936AAFB85B05B148A79E401CB364CF79DC47DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030A4A8C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcd38a38d1bb51c56372e208deb800972091130708d4ea031a1a250bfa4bb0c
Instruction ID: c49c5f06802b6e0138ff2a0d65fe65f4176396c153f503cde66e6c1f1aa643ce
Opcode Fuzzy Hash: 1fcd38a38d1bb51c56372e208deb800972091130708d4ea031a1a250bfa4bb0c
Instruction Fuzzy Hash: 65B16D74E116098FDB50CFEEE88179DFBF1AF88314F188529D418AB354EBB49885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030A936C Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d0c9fbd33821a3d0db10d2dd11b61e94a73a00422064278b26760dd336ad24
Instruction ID: 4131003799bda25f96f7fe5cbd8ff7decda4c66ffdda62f663315ebbac13a4cb
Opcode Fuzzy Hash: 85d0c9fbd33821a3d0db10d2dd11b61e94a73a00422064278b26760dd336ad24
Instruction Fuzzy Hash: 67913D35B01608DFDB54DBA8E984AADBBF6EF88310F148569E805D7364DB35EC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030A6CE4 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5eb4463811e5d5906af656a5f58a21203ed14775122a715af1d7e445f067709
Instruction ID: ede82cecf4276886cc6c6554f54ab3b10569bcef26e88e1de02a78e169486f73
Opcode Fuzzy Hash: d5eb4463811e5d5906af656a5f58a21203ed14775122a715af1d7e445f067709
Instruction Fuzzy Hash: 85510070E016188FDB18CFA9D885B9DBBF1BF48314F188429E819BB394D775A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030A6CF0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8cd33bfbb9372be30fb7684a6757198965d2e5199eb8047d06bf8b916f587d7
Instruction ID: 106f43ce1f44a36a08cfe33fcd6b7fc0575cc94efe8a18fdd25dfb9e2591b538
Opcode Fuzzy Hash: a8cd33bfbb9372be30fb7684a6757198965d2e5199eb8047d06bf8b916f587d7
Instruction Fuzzy Hash: 575102B4D016188FDB18CFA9D885B9DFBF1BF48314F188129E819BB390D779A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030A111B Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5962bf3e314ce75cc6c163d8315298607bb6951fd443d6e9de75d4996f0f20
Instruction ID: e9bf00952ee016d1f3ec12954ad72a900cd17a18a9b0a02a4e9785c4d8536c12
Opcode Fuzzy Hash: 4b5962bf3e314ce75cc6c163d8315298607bb6951fd443d6e9de75d4996f0f20
Instruction Fuzzy Hash: 7751E671302341DFCB09DF2CFE89A487B6DEB55344704A1A8D0055B2BADB38AD0ADFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030A1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2952305a68dc2d30fefca66b4fe9e44a3e967688fc7d6e0cf18c82d67654305e
Instruction ID: d2226f6d6ca17e416464b12949f21737f6ca6429ba8e2c9731ca2399a876274e
Opcode Fuzzy Hash: 2952305a68dc2d30fefca66b4fe9e44a3e967688fc7d6e0cf18c82d67654305e
Instruction Fuzzy Hash: B551A571302345DFCB19DF2CFE88A487B6DEB55344300A1A9D0455B2BADB386D1ADFA2

Uniqueness

Uniqueness Score: -1.00%

Function 030A96E8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1923fc50287c5458a72cb8b79de8f3c55f8d9c826ff81f18da49af4997ff26ea
Instruction ID: 687c238b3c385f33f760322ea390d589b80afb8c947b80b1526083ecc42e9f96
Opcode Fuzzy Hash: 1923fc50287c5458a72cb8b79de8f3c55f8d9c826ff81f18da49af4997ff26ea
Instruction Fuzzy Hash: D0319334B0160A4BDFA0DEEDE98076FB7EAEB85611F240869D50ADB380DB34DC458792

Uniqueness

Uniqueness Score: -1.00%

Function 030AF271 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd8dee88a31413d508d3ce2a224e0518b187e5db26f761fc812bb0462765eee
Instruction ID: c3482756f5c5dda7d750aa41150327db8ce059f983968dbc06de6d791406ac05
Opcode Fuzzy Hash: 5dd8dee88a31413d508d3ce2a224e0518b187e5db26f761fc812bb0462765eee
Instruction Fuzzy Hash: 6E319035E1060A8BDB09DFA9D89469EBBF6EF89300F148529E805E7350DB74EC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 030A26DD Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8320f7201611d0ec9a0fe3a0be182a16a52a7ad57884e0aecb7c136164a69b07
Instruction ID: ef66d4bc949f80c59c7cd1ab818c0aafdb57a00bf49c27e8c556ddbf22f07dde
Opcode Fuzzy Hash: 8320f7201611d0ec9a0fe3a0be182a16a52a7ad57884e0aecb7c136164a69b07
Instruction Fuzzy Hash: E4410DB0D012089FDB14DFA9C484ADEBBF9FF48310F248429E809AB254DB35A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030AF280 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd833d2fa6ddfeee8a5e69dbd0d2d860d39b74de9f0645499b779628506403c
Instruction ID: bb54d41252b4e6cd601fd771950578b2d599f836f25311097a15a6657357b59d
Opcode Fuzzy Hash: 9fd833d2fa6ddfeee8a5e69dbd0d2d860d39b74de9f0645499b779628506403c
Instruction Fuzzy Hash: 03317E35A1060A8BDB19DFA9D894A9EB7F6BF89300F108529E806E7350DB74AC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030A26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473479cf7f03e28195d7a942dbc7205435867c50ae7693278d83571b846f4b6a
Instruction ID: 990463a1490645f094c919c5f113e7d91cad45b0a556b7d48a06ce94e733c19a
Opcode Fuzzy Hash: 473479cf7f03e28195d7a942dbc7205435867c50ae7693278d83571b846f4b6a
Instruction Fuzzy Hash: BF41FDB0D012489FDB14DFA9C580ADEBFF9FF48310F248429E809AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030A9257 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9820348713fd96e8184a84f395f0791ae941fcbc0a9563a4a78c4f924ccdb392
Instruction ID: 310eda44f080972da1412b5a0671f28ee959ea0ec543c5ae0f4347356118e590
Opcode Fuzzy Hash: 9820348713fd96e8184a84f395f0791ae941fcbc0a9563a4a78c4f924ccdb392
Instruction Fuzzy Hash: FB31B335F0060A9BDB45CFA9E9946DEF7BAFF89300F148619E805AB240DB71D842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030A9268 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892b57a50a0858cf1192f2bd4e9ec25a4d279caa25cde419d8cc5ae6c935ed35
Instruction ID: 5a92d7243c0ac1a91999a32a7ea99cbb7bb3c8766f1dd0c3b0f6eae293860474
Opcode Fuzzy Hash: 892b57a50a0858cf1192f2bd4e9ec25a4d279caa25cde419d8cc5ae6c935ed35
Instruction Fuzzy Hash: 67218031F0060A9BDB45CFA9E49469EF7B6FF89300F14C659E805AB240DB759842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030A9158 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea7f1f1af3988f15c2e5ef38f9bf597b58e7e19580f010cfce0179f3cbaf0f6
Instruction ID: 2ae3a6cd1cafe22f52d8f5ecca08213e9c3fdce379644d2dc4c125fdc121e677
Opcode Fuzzy Hash: 9ea7f1f1af3988f15c2e5ef38f9bf597b58e7e19580f010cfce0179f3cbaf0f6
Instruction Fuzzy Hash: F121A430F056099BCB15CFADD8549DEF7F5AF89300F248559E815BB340DB709946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 030A169F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fd0a6a7dc5f788080d87b8412a04c13fa189abddcdad8a1fab95bffcf97891
Instruction ID: 7b819fff050c2f8593fcdcc8b5806abf8fea63a22b6ffa856b71673d25a67674
Opcode Fuzzy Hash: f0fd0a6a7dc5f788080d87b8412a04c13fa189abddcdad8a1fab95bffcf97891
Instruction Fuzzy Hash: 0B21D3743006014BDB59EA6CF888B5E37AEEB49385F147661D40ACB265DB38DC458B91

Uniqueness

Uniqueness Score: -1.00%

Function 030A1878 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae19d1231f4d6805ad3a5f2d921f38b67da0ec051ef2c26ca662f377ebb1b4e
Instruction ID: a26f65f84529af599b7aa73341d9c671810a94611b3993d0d5b7280cc75e5d69
Opcode Fuzzy Hash: dae19d1231f4d6805ad3a5f2d921f38b67da0ec051ef2c26ca662f377ebb1b4e
Instruction Fuzzy Hash: 8521AD30B06655CFDB68DBACE5146EEB7F6AF89200F1404B9C006EB3A0DB358C01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030A4F89 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c121f82a9f928997dc8aa41a4b330018b9c5796d91eb15002b6176eeb4cf44
Instruction ID: 7b7ab69ed0edbe58bae589948924db502084a559eb25bd0d0090506ac2a8bd1d
Opcode Fuzzy Hash: 49c121f82a9f928997dc8aa41a4b330018b9c5796d91eb15002b6176eeb4cf44
Instruction Fuzzy Hash: F1211C34601604CFCB54DFA9E958AAEBBF5FF89204F1044A9E406EB3A4DB759D01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0169D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245080521.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_169d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3133582eb52a45096093ab995e272b6bb8a3c2c80cd1c7cd9d316f792dd580f8
Instruction ID: cf948148d0bc5d3c3fbf77094b0b8a0c76cc8dfe0bddc0c6adf47685ab86e07b
Opcode Fuzzy Hash: 3133582eb52a45096093ab995e272b6bb8a3c2c80cd1c7cd9d316f792dd580f8
Instruction Fuzzy Hash: 80210071604200DFDF15DFA8D984B26BF69FB88354F20C579D90A0B396C33AD407CA61

Uniqueness

Uniqueness Score: -1.00%

Function 030A1383 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9565a943705f49821b38df09b895b68a2c5905043e0dd890a7c01203bdec057
Instruction ID: 36cf0300489df1c665b1be1dcdebdc368aeb528a9b8f63d6998ad83f9ef18558
Opcode Fuzzy Hash: b9565a943705f49821b38df09b895b68a2c5905043e0dd890a7c01203bdec057
Instruction Fuzzy Hash: A7212C306026004BEB7CDAACF99976D7AADEB46365F540479F406CB790CA39CC41C743

Uniqueness

Uniqueness Score: -1.00%

Function 030A9A28 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c66a01a02a8b7f25540d35f85c5b3cdc034babb4e44d618f522a22d90e0ba0
Instruction ID: c7831c83515631729d7ff908a5b7759da6769b2c37613b79f4c018c56242a72e
Opcode Fuzzy Hash: 77c66a01a02a8b7f25540d35f85c5b3cdc034babb4e44d618f522a22d90e0ba0
Instruction Fuzzy Hash: 1F219F31B005198FDB54DBADD954BAE7BFABF88710F14806AE505EB3A4DBB1DC008B90

Uniqueness

Uniqueness Score: -1.00%

Function 030A9168 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686d99a0eb6fd5fb8603eee8e307be684c9a767a7373b0f13669d7653f9512ad
Instruction ID: bb446402d960802207f3bcb49547ed6ce89883e68cf840fbe1ad6c355a76fbae
Opcode Fuzzy Hash: 686d99a0eb6fd5fb8603eee8e307be684c9a767a7373b0f13669d7653f9512ad
Instruction Fuzzy Hash: 9E218030F016099BCB19CFA9D8549DEF7B6AF89300F24855AE815BB340DB70A941CB51

Uniqueness

Uniqueness Score: -1.00%

Function 030A1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4178717e51410007033e16991a1d773f3e7af299df141e5920975e4e32826f0
Instruction ID: 85d1b6ff1998fa0414c2b56b59ff87e2d6d45e31ff463ec6c81b17b32ba47c09
Opcode Fuzzy Hash: f4178717e51410007033e16991a1d773f3e7af299df141e5920975e4e32826f0
Instruction Fuzzy Hash: E0216D30B06615CFDB68EBACE5556AE77F6AF89200F2404A8D106EB390DB358D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030A16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d56ee248d78f9e6e89f3fe13975dee593fe52579212c973e8b1d2136b58919
Instruction ID: 168b64ed0e53bf58d0b4a53c3996a5cfaaaaf420e2698f478e16948589e9bf2f
Opcode Fuzzy Hash: d0d56ee248d78f9e6e89f3fe13975dee593fe52579212c973e8b1d2136b58919
Instruction Fuzzy Hash: 1D2181343006014FDB69DB6CF888B5E37AEEB49385F147661E40AC7255DB38DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030A4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88001452f078f54c313c530b6fffcf4b574da8ce504dedc793380cc2e9913f5f
Instruction ID: 7146528655e17aa71cdf1e4c58615bbc80827ad77083e3175ba805d1559d7faf
Opcode Fuzzy Hash: 88001452f078f54c313c530b6fffcf4b574da8ce504dedc793380cc2e9913f5f
Instruction Fuzzy Hash: DE212C34701604CFDB54DB79E958AAEB7F5FB49204F1004A8E406EB3A4DB759D01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030A0838 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc66e1a018736348f7dab3ba05483749f2e73ac9b5d05da583073a44744cc13e
Instruction ID: 2ff9139c91cde91db62652caeb007c2e9cfcbe6a55e23d574e9656dbbea6c040
Opcode Fuzzy Hash: bc66e1a018736348f7dab3ba05483749f2e73ac9b5d05da583073a44744cc13e
Instruction Fuzzy Hash: ED112630A027084BEFA4DAFCF84432E7698EB46250F1849BAD442CF251D625CC418BC5

Uniqueness

Uniqueness Score: -1.00%

Function 030A0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6276b9d82a4441494ff564337079a600c846a1a794b667b51dbf743fb548d179
Instruction ID: 1bec8afe7d936d3cbaaf6cb340dd3a50b34c600e135c26eab44101bb04276448
Opcode Fuzzy Hash: 6276b9d82a4441494ff564337079a600c846a1a794b667b51dbf743fb548d179
Instruction Fuzzy Hash: 8C11C130B0270C4BEFA4DABCF80472E72D9EB45294F1449B9D046CF290DA29CC858BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0169D006 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245080521.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_169d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c243d87846a209092497f1b85f6d88016745191cb4d1e658ab64446f17b9557a
Instruction ID: cf285cfb3fcb6c70a4068f0e987ebdf55d2d598ffbc21c445d2c1afe8787f2dc
Opcode Fuzzy Hash: c243d87846a209092497f1b85f6d88016745191cb4d1e658ab64446f17b9557a
Instruction Fuzzy Hash: 7F219F755083809FDB02CF64D994B11BFB5FB46314F24C5EAD8498F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 030A17C0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fec6457e4909df970dc220252852997b2c3a58708bddea5651bbc6137006f41
Instruction ID: 1429d2c27542969e244cb7d5d03ab785093518783f94daefb5d4a44de11b301c
Opcode Fuzzy Hash: 6fec6457e4909df970dc220252852997b2c3a58708bddea5651bbc6137006f41
Instruction Fuzzy Hash: 4711E976F007119FDB54DFBDA84875E7BFAEB48620F144565E815D3380EB34C9018B96

Uniqueness

Uniqueness Score: -1.00%

Function 030A1488 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf23ec500a55d1d49a574e672883137cc6eea95c389481ff639398e0a7045a3
Instruction ID: e68ca9b1a7a4112aa7b0bb96f479b1fb64079973c3bb59c503cc8e40dc80cbd3
Opcode Fuzzy Hash: 1bf23ec500a55d1d49a574e672883137cc6eea95c389481ff639398e0a7045a3
Instruction Fuzzy Hash: 83117075A026159FCB69EFFCA4902AD7AF5EB48260F1404B9D806EB341E635C9418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 030A1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f73416ea9d30a429bc558901fb2098abec5e94b3951302e36b1f04c7087f19e
Instruction ID: 630c4df0ba45e462c182e5179ab77607b18c4c6a13f580279620d981f99cb7f2
Opcode Fuzzy Hash: 0f73416ea9d30a429bc558901fb2098abec5e94b3951302e36b1f04c7087f19e
Instruction Fuzzy Hash: AC012135A027149FCB65EFFCA45029E77E5EB49250F150479D805EB300E735D9418B95

Uniqueness

Uniqueness Score: -1.00%

Function 030A9890 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbcd49c390d9e485f36edd7c6c3aefcb908ce300e211ced8cb1a30a6b9595115
Instruction ID: aa32bf474d95a1dd5605e6daecc5399cebaca7f055800e127496491ed3bd1a33
Opcode Fuzzy Hash: cbcd49c390d9e485f36edd7c6c3aefcb908ce300e211ced8cb1a30a6b9595115
Instruction Fuzzy Hash: 9301B530B001098FCB04EF99E994A8ABBAAFF80710F54C274C80C5F299DB74E946C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 030A80F8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f974ea40644646b9d45cc4d557eca127b811d4a595810db385ceaeb4f3559916
Instruction ID: 958b3dd94720d8f3fc6d3874865ed9d355e2ef320c0aa79c4fd8e7083dff82eb
Opcode Fuzzy Hash: f974ea40644646b9d45cc4d557eca127b811d4a595810db385ceaeb4f3559916
Instruction Fuzzy Hash: AD018434600249DFCB09EFB8F9849DC7BB9EF45244F1056B8C4149B265DA355E0ADB51

Uniqueness

Uniqueness Score: -1.00%

Function 030A7098 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d41b1576c2078ef455a36712943d8bc26b7345a1cb4828ae65d893b7f05ec8
Instruction ID: 3a8cb3e2fa30cd6ad1ab471889a1756152d6a4a2ee070b9429da34a81cc1eae5
Opcode Fuzzy Hash: f5d41b1576c2078ef455a36712943d8bc26b7345a1cb4828ae65d893b7f05ec8
Instruction Fuzzy Hash: E5F0C435B00118CFD714EBA4D598B6DB7B6EF88615F1480A8E50A9B3A0CF35AD42DB41

Uniqueness

Uniqueness Score: -1.00%

Function 030A8108 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b673e1996d31aff2660dc20784854a15c73e5c02d8f01e02189abc1698aa0883
Instruction ID: 8693a41e8524a145c52e7f23b3ef4b779aa367fb5028b35811cb38bd1a214dc7
Opcode Fuzzy Hash: b673e1996d31aff2660dc20784854a15c73e5c02d8f01e02189abc1698aa0883
Instruction Fuzzy Hash: BDF03130A00209DFCB05EFB8F99499D7BBAEF44344F5056B8C4049B254DB39AE0ADB91

Uniqueness

Uniqueness Score: -1.00%

Function 030A6C14 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3245274373.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30a0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5c84a876baccbe6d06550c11bddef624980fe578e409af2b2b55962569720c
Instruction ID: ef345050cea2d39363bfcbd7ad5469377de74a0803d1558772b71159dab5acb5
Opcode Fuzzy Hash: 1a5c84a876baccbe6d06550c11bddef624980fe578e409af2b2b55962569720c
Instruction Fuzzy Hash: 73C0123A3180508F8602A76CE0644B937B1DBCA12A32800EAE149CF322CE2298028B40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SWIFT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
SWIFT.exe

Function 058BDCC8 Relevance: 8.5, Strings: 6, Instructions: 1042
COMMON

Function 0197ADA8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 019744B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0197590C Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 058B4040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 0197D27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0197D689 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 0197A130 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0197B219 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Function 08A60C34 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre