Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SWIFT.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SWIFT.exe
|
"C:\Users\user\Desktop\SWIFT.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://mail.quoctoan.vn
|
unknown
|
||
|
http://mail92152.maychuemail.com
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail92152.maychuemail.com
|
112.213.92.152
|
|
|
|
mail.quoctoan.vn
|
unknown
|
|
|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
||
|
fp2e7a.wpc.phicdn.net
|
192.229.211.108
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
112.213.92.152
|
mail92152.maychuemail.com
|
Viet Nam
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
32A6000
|
trusted library allocation
|
page read and write
|
|
|
|
5AF0000
|
trusted library section
|
page read and write
|
|
|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
505D000
|
trusted library allocation
|
page read and write
|
|
|
|
329E000
|
trusted library allocation
|
page read and write
|
|
|
|
3251000
|
trusted library allocation
|
page read and write
|
|
|
|
4309000
|
trusted library allocation
|
page read and write
|
|
|
|
F82000
|
unkown
|
page readonly
|
||
|
585E000
|
stack
|
page read and write
|
||
|
5801000
|
trusted library allocation
|
page read and write
|
||
|
1690000
|
trusted library allocation
|
page read and write
|
||
|
1990000
|
heap
|
page execute and read and write
|
||
|
13D5000
|
heap
|
page read and write
|
||
|
5CC7000
|
heap
|
page read and write
|
||
|
5EFE000
|
stack
|
page read and write
|
||
|
579D000
|
trusted library allocation
|
page read and write
|
||
|
5791000
|
trusted library allocation
|
page read and write
|
||
|
501D000
|
trusted library allocation
|
page read and write
|
||
|
5258000
|
trusted library allocation
|
page read and write
|
||
|
169E000
|
stack
|
page read and write
|
||
|
58A2000
|
trusted library allocation
|
page read and write
|
||
|
577B000
|
trusted library allocation
|
page read and write
|
||
|
6598000
|
heap
|
page read and write
|
||
|
16E0000
|
heap
|
page read and write
|
||
|
5300000
|
trusted library section
|
page read and write
|
||
|
30A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
6F20000
|
heap
|
page read and write
|
||
|
59F0000
|
heap
|
page read and write
|
||
|
13A0000
|
heap
|
page read and write
|
||
|
68F7000
|
trusted library allocation
|
page read and write
|
||
|
1913000
|
trusted library allocation
|
page execute and read and write
|
||
|
5F40000
|
trusted library allocation
|
page read and write
|
||
|
6EF0000
|
trusted library allocation
|
page read and write
|
||
|
59DE000
|
stack
|
page read and write
|
||
|
16B2000
|
trusted library allocation
|
page read and write
|
||
|
1A4F000
|
trusted library allocation
|
page read and write
|
||
|
68AE000
|
stack
|
page read and write
|
||
|
59DE000
|
stack
|
page read and write
|
||
|
11B7000
|
stack
|
page read and write
|
||
|
4259000
|
trusted library allocation
|
page read and write
|
||
|
36DA000
|
trusted library allocation
|
page read and write
|
||
|
5850000
|
trusted library allocation
|
page read and write
|
||
|
1683000
|
trusted library allocation
|
page execute and read and write
|
||
|
1510000
|
heap
|
page read and write
|
||
|
8651000
|
trusted library allocation
|
page read and write
|
||
|
5B2C000
|
stack
|
page read and write
|
||
|
5820000
|
trusted library allocation
|
page read and write
|
||
|
16BA000
|
trusted library allocation
|
page execute and read and write
|
||
|
C3FF000
|
stack
|
page read and write
|
||
|
16C5000
|
trusted library allocation
|
page execute and read and write
|
||
|
1555000
|
heap
|
page read and write
|
||
|
C5FE000
|
stack
|
page read and write
|
||
|
5893000
|
heap
|
page read and write
|
||
|
67A0000
|
trusted library allocation
|
page read and write
|
||
|
329C000
|
trusted library allocation
|
page read and write
|
||
|
5C2E000
|
stack
|
page read and write
|
||
|
5F43000
|
trusted library allocation
|
page read and write
|
||
|
1680000
|
trusted library allocation
|
page read and write
|
||
|
18DF000
|
stack
|
page read and write
|
||
|
5830000
|
trusted library allocation
|
page read and write
|
||
|
15DD000
|
heap
|
page read and write
|
||
|
17DE000
|
stack
|
page read and write
|
||
|
C1FE000
|
stack
|
page read and write
|
||
|
577E000
|
trusted library allocation
|
page read and write
|
||
|
1A3C000
|
stack
|
page read and write
|
||
|
6AAE000
|
stack
|
page read and write
|
||
|
36F3000
|
trusted library allocation
|
page read and write
|
||
|
1930000
|
trusted library allocation
|
page read and write
|
||
|
4CF7000
|
trusted library allocation
|
page read and write
|
||
|
5E2E000
|
stack
|
page read and write
|
||
|
1417000
|
heap
|
page read and write
|
||
|
8A60000
|
trusted library allocation
|
page execute and read and write
|
||
|
5D2F000
|
stack
|
page read and write
|
||
|
1438000
|
heap
|
page read and write
|
||
|
5890000
|
heap
|
page read and write
|
||
|
14C0000
|
heap
|
page read and write
|
||
|
143C000
|
heap
|
page read and write
|
||
|
30C0000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
5380000
|
trusted library allocation
|
page read and write
|
||
|
65F6000
|
heap
|
page read and write
|
||
|
57A2000
|
trusted library allocation
|
page read and write
|
||
|
10BA000
|
stack
|
page read and write
|
||
|
542E000
|
stack
|
page read and write
|
||
|
5F00000
|
trusted library allocation
|
page execute and read and write
|
||
|
5FB8000
|
trusted library allocation
|
page read and write
|
||
|
30B0000
|
trusted library allocation
|
page read and write
|
||
|
5B10000
|
trusted library allocation
|
page read and write
|
||
|
334F000
|
trusted library allocation
|
page read and write
|
||
|
1980000
|
trusted library allocation
|
page read and write
|
||
|
4BBE000
|
trusted library allocation
|
page read and write
|
||
|
57E4000
|
trusted library allocation
|
page read and write
|
||
|
58A0000
|
trusted library allocation
|
page read and write
|
||
|
16C7000
|
trusted library allocation
|
page execute and read and write
|
||
|
4251000
|
trusted library allocation
|
page read and write
|
||
|
193A000
|
trusted library allocation
|
page execute and read and write
|
||
|
30D0000
|
heap
|
page execute and read and write
|
||
|
5A20000
|
heap
|
page execute and read and write
|
||
|
58A0000
|
heap
|
page read and write
|
||
|
1500000
|
heap
|
page read and write
|
||
|
16C2000
|
trusted library allocation
|
page read and write
|
||
|
1520000
|
heap
|
page read and write
|
||
|
5CAE000
|
stack
|
page read and write
|
||
|
C23E000
|
stack
|
page read and write
|
||
|
1535000
|
heap
|
page read and write
|
||
|
532C000
|
stack
|
page read and write
|
||
|
65B0000
|
heap
|
page read and write
|
||
|
5DB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
57EB000
|
trusted library allocation
|
page read and write
|
||
|
1420000
|
heap
|
page read and write
|
||
|
1630000
|
heap
|
page read and write
|
||
|
C4FF000
|
stack
|
page read and write
|
||
|
5398000
|
trusted library allocation
|
page read and write
|
||
|
CABE000
|
stack
|
page read and write
|
||
|
7F500000
|
trusted library allocation
|
page execute and read and write
|
||
|
5782000
|
trusted library allocation
|
page read and write
|
||
|
1910000
|
trusted library allocation
|
page read and write
|
||
|
59E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
68EE000
|
stack
|
page read and write
|
||
|
19A0000
|
trusted library allocation
|
page read and write
|
||
|
57FE000
|
trusted library allocation
|
page read and write
|
||
|
65EA000
|
heap
|
page read and write
|
||
|
5CB0000
|
heap
|
page read and write
|
||
|
1A50000
|
heap
|
page read and write
|
||
|
142A000
|
heap
|
page read and write
|
||
|
C740000
|
heap
|
page read and write
|
||
|
5FB0000
|
trusted library allocation
|
page read and write
|
||
|
4301000
|
trusted library allocation
|
page read and write
|
||
|
13D8000
|
heap
|
page read and write
|
||
|
1960000
|
trusted library allocation
|
page read and write
|
||
|
1670000
|
trusted library allocation
|
page read and write
|
||
|
5DFE000
|
stack
|
page read and write
|
||
|
8A3E000
|
stack
|
page read and write
|
||
|
660E000
|
heap
|
page read and write
|
||
|
680D000
|
stack
|
page read and write
|
||
|
57B4000
|
trusted library allocation
|
page read and write
|
||
|
1650000
|
heap
|
page read and write
|
||
|
6900000
|
trusted library allocation
|
page read and write
|
||
|
1547000
|
heap
|
page read and write
|
||
|
580D000
|
trusted library allocation
|
page read and write
|
||
|
5776000
|
trusted library allocation
|
page read and write
|
||
|
578E000
|
trusted library allocation
|
page read and write
|
||
|
5A1E000
|
stack
|
page read and write
|
||
|
549C000
|
stack
|
page read and write
|
||
|
8A50000
|
trusted library allocation
|
page read and write
|
||
|
4279000
|
trusted library allocation
|
page read and write
|
||
|
5825000
|
trusted library allocation
|
page read and write
|
||
|
1530000
|
heap
|
page read and write
|
||
|
7140000
|
heap
|
page read and write
|
||
|
311E000
|
stack
|
page read and write
|
||
|
5993000
|
heap
|
page read and write
|
||
|
6594000
|
heap
|
page read and write
|
||
|
1923000
|
trusted library allocation
|
page read and write
|
||
|
5F30000
|
trusted library allocation
|
page read and write
|
||
|
16B6000
|
trusted library allocation
|
page execute and read and write
|
||
|
1505000
|
heap
|
page read and write
|
||
|
68F0000
|
trusted library allocation
|
page read and write
|
||
|
1940000
|
trusted library allocation
|
page read and write
|
||
|
1684000
|
trusted library allocation
|
page read and write
|
||
|
1358000
|
stack
|
page read and write
|
||
|
1970000
|
trusted library allocation
|
page execute and read and write
|
||
|
1A40000
|
trusted library allocation
|
page read and write
|
||
|
15C5000
|
heap
|
page read and write
|
||
|
1510000
|
heap
|
page read and write
|
||
|
5890000
|
heap
|
page read and write
|
||
|
1528000
|
heap
|
page read and write
|
||
|
5980000
|
trusted library allocation
|
page read and write
|
||
|
32B3000
|
trusted library allocation
|
page read and write
|
||
|
3301000
|
trusted library allocation
|
page read and write
|
||
|
1914000
|
trusted library allocation
|
page read and write
|
||
|
5F20000
|
heap
|
page read and write
|
||
|
169D000
|
trusted library allocation
|
page execute and read and write
|
||
|
67B0000
|
trusted library allocation
|
page read and write
|
||
|
89CD000
|
stack
|
page read and write
|
||
|
6590000
|
heap
|
page read and write
|
||
|
5812000
|
trusted library allocation
|
page read and write
|
||
|
42BA000
|
trusted library allocation
|
page read and write
|
||
|
3120000
|
heap
|
page read and write
|
||
|
4B70000
|
trusted library allocation
|
page read and write
|
||
|
3450000
|
trusted library allocation
|
page read and write
|
||
|
19FE000
|
stack
|
page read and write
|
||
|
1936000
|
trusted library allocation
|
page execute and read and write
|
||
|
57B0000
|
trusted library allocation
|
page read and write
|
||
|
13BF000
|
heap
|
page read and write
|
||
|
1562000
|
heap
|
page read and write
|
||
|
1942000
|
trusted library allocation
|
page read and write
|
||
|
3140000
|
heap
|
page read and write
|
||
|
1920000
|
trusted library allocation
|
page read and write
|
||
|
679C000
|
trusted library allocation
|
page read and write
|
||
|
5390000
|
trusted library allocation
|
page read and write
|
||
|
FEF70000
|
trusted library allocation
|
page execute and read and write
|
||
|
194B000
|
trusted library allocation
|
page execute and read and write
|
||
|
19B0000
|
heap
|
page read and write
|
||
|
58B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5CC0000
|
heap
|
page read and write
|
||
|
179F000
|
stack
|
page read and write
|
||
|
16C0000
|
trusted library allocation
|
page read and write
|
||
|
5770000
|
trusted library allocation
|
page read and write
|
||
|
324F000
|
stack
|
page read and write
|
||
|
67B6000
|
trusted library allocation
|
page read and write
|
||
|
C97E000
|
stack
|
page read and write
|
||
|
65EC000
|
heap
|
page read and write
|
||
|
5796000
|
trusted library allocation
|
page read and write
|
||
|
4C0C000
|
trusted library allocation
|
page read and write
|
||
|
F80000
|
unkown
|
page readonly
|
||
|
67C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
C9BD000
|
stack
|
page read and write
|
||
|
191D000
|
trusted library allocation
|
page execute and read and write
|
||
|
16A0000
|
heap
|
page read and write
|
||
|
88CB000
|
stack
|
page read and write
|
||
|
16B0000
|
trusted library allocation
|
page read and write
|
||
|
192D000
|
trusted library allocation
|
page execute and read and write
|
||
|
32FE000
|
stack
|
page read and write
|
||
|
5990000
|
heap
|
page read and write
|
||
|
13CB000
|
heap
|
page read and write
|
||
|
578A000
|
trusted library allocation
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
16CB000
|
trusted library allocation
|
page execute and read and write
|
||
|
57C0000
|
trusted library allocation
|
page read and write
|
||
|
1947000
|
trusted library allocation
|
page execute and read and write
|
||
|
581C000
|
stack
|
page read and write
|
||
|
32BB000
|
trusted library allocation
|
page read and write
|
||
|
5806000
|
trusted library allocation
|
page read and write
|
||
|
1476000
|
heap
|
page read and write
|
||
|
6790000
|
trusted library allocation
|
page read and write
|
||
|
155F000
|
heap
|
page read and write
|
||
|
C63D000
|
stack
|
page read and write
|
||
|
1409000
|
heap
|
page read and write
|
||
|
5B30000
|
heap
|
page execute and read and write
|
||
|
152E000
|
heap
|
page read and write
|
||
|
57E0000
|
trusted library allocation
|
page read and write
|
||
|
1900000
|
trusted library allocation
|
page read and write
|
||
|
6810000
|
trusted library allocation
|
page execute and read and write
|
||
|
C87E000
|
stack
|
page read and write
|
||
|
3090000
|
trusted library allocation
|
page read and write
|
||
|
125A000
|
stack
|
page read and write
|
||
|
168D000
|
trusted library allocation
|
page execute and read and write
|
||
|
C73D000
|
stack
|
page read and write
|
||
|
6F30000
|
trusted library allocation
|
page execute and read and write
|
There are 229 hidden memdumps, click here to show them.