Analysis Report Swift doc. ZD.1.19022021_PDF.exe

Overview

General Information

Sample Name:	Swift doc. ZD.1.19022021_PDF.exe
Analysis ID:	358328
MD5:	5679c66fd0ebcd6b8702c5c9e8f1ecb6
SHA1:	dbba96ad2d1c3811812eadd985401822f9ef54b9
SHA256:	949138db57c941e64a0a14bc7e87f68576dadf09f8ac56faa6776476161fb0b8
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM_3

.NET source code contains very large strings

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Signatures

AV Detection:

Found malware configuration

Source: Swift doc. ZD.1.19022021_PDF.exe.7020.1.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "SYgLhOXLAKJaD", "URL: ": "https://T4gAxtuj18rwIFW1VRIf.com", "To: ": "fikriye@turuncoglu.com", "ByHost: ": "smtp.yandex.com:587", "Password: ": "EbOiB", "From: ": "fikriye@turuncoglu.com"}

Multi AV Scanner detection for submitted file

Source: Swift doc. ZD.1.19022021_PDF.exe

ReversingLabs: Detection: 10%

Machine Learning detection for sample

Source: Swift doc. ZD.1.19022021_PDF.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://T4gAxtuj18rwIFW1VRIf.com

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49765 -> 77.88.21.158:587

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 77.88.21.158 77.88.21.158

Uses SMTP (mail sending)

Source: global traffic

TCP traffic: 192.168.2.4:49765 -> 77.88.21.158:587

Source: unknown

DNS traffic detected: queries for: smtp.yandex.com

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: http://NfuOAc.com
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ycasha2.cer0
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.919606289.0000000003566000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.yandex.com
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com0.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://yandex.ocsp-responder.com03
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.919506938.000000000351D000.00000004.00000001.sdmp	String found in binary or memory: https://T4gAxtuj18rwIFW1VRIf.com
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.922521029.000000000448B000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a window with clipboard capturing capabilities

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large strings

Source: Swift doc. ZD.1.19022021_PDF.exe, frmSplashScreen.cs

Long String: Length: 13656

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Swift doc. ZD.1.19022021_PDF.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01769608	1_2_01769608
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0176C2A8	1_2_0176C2A8
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0176AB34	1_2_0176AB34
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01838190	1_2_01838190
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183A1F8	1_2_0183A1F8
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_018344C0	1_2_018344C0
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183C9F0	1_2_0183C9F0
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183D9F8	1_2_0183D9F8
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01835900	1_2_01835900
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01831EF0	1_2_01831EF0
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183AE20	1_2_0183AE20
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183A199	1_2_0183A199
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01837010	1_2_01837010
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183C9EA	1_2_0183C9EA
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01864880	1_2_01864880
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01868312	1_2_01868312
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01862530	1_2_01862530
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01867CC0	1_2_01867CC0

Sample file is different than original file name gathered from version info

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000000.647670906.0000000000EBA000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRSAPKCS1SignatureDescription.exe< vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916315212.0000000001840000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.921926825.0000000004241000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLegacyPathHandling.dllN vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.922521029.000000000448B000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameJjuAGuEggFLyNdgxhZLJIKFOcxph.exe4 vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000003.843393717.00000000015C7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameclr.dl<fQ vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAsyncState.dllF vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916284500.0000000001820000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe	Binary or memory string: OriginalFilenameRSAPKCS1SignatureDescription.exe< vs Swift doc. ZD.1.19022021_PDF.exe

Uses 32bit PE files

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Swift doc. ZD.1.19022021_PDF.exe, frmSplashScreen.cs

Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/2

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Mutant created: \Sessions\1\BaseNamedObjects\ePyGDQmBPgOdlidu

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);

Source: Swift doc. ZD.1.19022021_PDF.exe

ReversingLabs: Detection: 10%

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183C140 push esp; ret		1_2_0183C141
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183D578 pushfd ; iretd		1_2_0183D585

Source: initial sample

Static PE information: section name: .text entropy: 7.03776347249

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Source: Yara match	File source: 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift doc. ZD.1.19022021_PDF.exe PID: 7020, type: MEMORY
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.3270530.2.raw.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Window / User API: threadDelayed 735			Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Window / User API: threadDelayed 9117			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe TID: 7024	Thread sleep time: -99106s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe TID: 4780	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe TID: 4484	Thread sleep count: 735 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe TID: 4484	Thread sleep count: 9117 > 30	Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Code function: 1_2_01835900 LdrInitializeThunk,

1_2_01835900

Enables debug privileges

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916402707.0000000001CB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916402707.0000000001CB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916402707.0000000001CB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916402707.0000000001CB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Source: Yara match	File source: 00000001.00000002.922521029.000000000448B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.923663679.00000000063E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift doc. ZD.1.19022021_PDF.exe PID: 7020, type: MEMORY
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.63e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.44f98c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.44f98c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.63e0000.9.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift doc. ZD.1.19022021_PDF.exe PID: 7020, type: MEMORY
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.3270530.2.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected AgentTesla

Source: Yara match	File source: 00000001.00000002.922521029.000000000448B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.923663679.00000000063E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift doc. ZD.1.19022021_PDF.exe PID: 7020, type: MEMORY
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.63e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.44f98c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.44f98c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.63e0000.9.unpack, type: UNPACKEDPE

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.88.21.158	unknown	Russian Federation		13238	YANDEXRU	false

Private

IP
192.168.2.1

Contacted Domains

Name	IP	Active
smtp.yandex.ru	77.88.21.158	true
smtp.yandex.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://T4gAxtuj18rwIFW1VRIf.com	true	Avira URL Cloud: safe	unknown

AV Detection:

Found malware configuration

Source: Swift doc. ZD.1.19022021_PDF.exe.7020.1.memstr

Multi AV Scanner detection for submitted file

Source: Swift doc. ZD.1.19022021_PDF.exe

ReversingLabs: Detection: 10%

Machine Learning detection for sample

Source: Swift doc. ZD.1.19022021_PDF.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://T4gAxtuj18rwIFW1VRIf.com

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49765 -> 77.88.21.158:587

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 77.88.21.158 77.88.21.158

Uses SMTP (mail sending)

Source: global traffic

TCP traffic: 192.168.2.4:49765 -> 77.88.21.158:587

Source: unknown

DNS traffic detected: queries for: smtp.yandex.com

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: http://NfuOAc.com
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ycasha2.cer0
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.919606289.0000000003566000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.yandex.com
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com0.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: http://yandex.ocsp-responder.com03
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.919506938.000000000351D000.00000004.00000001.sdmp	String found in binary or memory: https://T4gAxtuj18rwIFW1VRIf.com
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.922521029.000000000448B000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a window with clipboard capturing capabilities

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large strings

Source: Swift doc. ZD.1.19022021_PDF.exe, frmSplashScreen.cs

Long String: Length: 13656

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Swift doc. ZD.1.19022021_PDF.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01769608	1_2_01769608
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0176C2A8	1_2_0176C2A8
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0176AB34	1_2_0176AB34
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01838190	1_2_01838190
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183A1F8	1_2_0183A1F8
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_018344C0	1_2_018344C0
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183C9F0	1_2_0183C9F0
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183D9F8	1_2_0183D9F8
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01835900	1_2_01835900
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01831EF0	1_2_01831EF0
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183AE20	1_2_0183AE20
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183A199	1_2_0183A199
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01837010	1_2_01837010
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183C9EA	1_2_0183C9EA
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01864880	1_2_01864880
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01868312	1_2_01868312
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01862530	1_2_01862530
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_01867CC0	1_2_01867CC0

Sample file is different than original file name gathered from version info

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000000.647670906.0000000000EBA000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRSAPKCS1SignatureDescription.exe< vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916315212.0000000001840000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.921926825.0000000004241000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLegacyPathHandling.dllN vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.922521029.000000000448B000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameJjuAGuEggFLyNdgxhZLJIKFOcxph.exe4 vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000003.843393717.00000000015C7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameclr.dl<fQ vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAsyncState.dllF vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916284500.0000000001820000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs Swift doc. ZD.1.19022021_PDF.exe
Source: Swift doc. ZD.1.19022021_PDF.exe	Binary or memory string: OriginalFilenameRSAPKCS1SignatureDescription.exe< vs Swift doc. ZD.1.19022021_PDF.exe

Uses 32bit PE files

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Swift doc. ZD.1.19022021_PDF.exe, frmSplashScreen.cs

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@2/2

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Mutant created: \Sessions\1\BaseNamedObjects\ePyGDQmBPgOdlidu

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);

Source: Swift doc. ZD.1.19022021_PDF.exe

ReversingLabs: Detection: 10%

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Swift doc. ZD.1.19022021_PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183C140 push esp; ret		1_2_0183C141
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Code function: 1_2_0183D578 pushfd ; iretd		1_2_0183D585

Source: initial sample

Static PE information: section name: .text entropy: 7.03776347249

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Source: Yara match	File source: 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift doc. ZD.1.19022021_PDF.exe PID: 7020, type: MEMORY
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.3270530.2.raw.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Window / User API: threadDelayed 735			Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Window / User API: threadDelayed 9117			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe TID: 7024	Thread sleep time: -99106s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe TID: 4780	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe TID: 4484	Thread sleep count: 735 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe TID: 4484	Thread sleep count: 9117 > 30	Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.924041258.0000000006DAF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.923788189.0000000006940000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Code function: 1_2_01835900 LdrInitializeThunk,

1_2_01835900

Enables debug privileges

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916402707.0000000001CB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916402707.0000000001CB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916402707.0000000001CB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Swift doc. ZD.1.19022021_PDF.exe, 00000001.00000002.916402707.0000000001CB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Source: Yara match	File source: 00000001.00000002.922521029.000000000448B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.923663679.00000000063E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift doc. ZD.1.19022021_PDF.exe PID: 7020, type: MEMORY
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.63e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.44f98c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.44f98c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.63e0000.9.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\Swift doc. ZD.1.19022021_PDF.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 00000001.00000002.917324348.0000000003241000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift doc. ZD.1.19022021_PDF.exe PID: 7020, type: MEMORY
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.3270530.2.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected AgentTesla

Source: Yara match	File source: 00000001.00000002.922521029.000000000448B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.923663679.00000000063E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift doc. ZD.1.19022021_PDF.exe PID: 7020, type: MEMORY
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.63e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.44f98c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.44f98c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Swift doc. ZD.1.19022021_PDF.exe.63e0000.9.unpack, type: UNPACKEDPE

ID:	358328
Product:	CloudBasic
Start time:	12:19:54
Start date:	25.02.2021
Sample:	Swift doc. ZD.1.19022021_PDF.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	5679c66fd0ebcd6b8702c5c9e8f1ecb6
SHA1:	dbba96ad2d1c3811812eadd985401822f9ef54b9
SHA256:	949138db57c941e64a0a14bc7e87f68576dadf09f8ac56faa6776476161fb0b8
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Analysis Report Swift doc. ZD.1.19022021_PDF.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs