Analysis Report SWIFT COPY.pdf.exe

Overview

General Information

Sample Name: SWIFT COPY.pdf.exe
Analysis ID: 412589
MD5: d01daeb6c9af5256a25dffe76a448f04
SHA1: 50aab2959bbc6d9e31eb477e6602ffbcb64343ce
SHA256: 490ae1eb1637910af1a69c6317ef81a47518b809f5b6da4b8f66d72582e25b9b
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "imam@esquiresweaters.comEsquire@#2078mail.esquiresweaters.comkingmangreatgoldenqlory@yandex.com"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\bSlxGzdE.exe ReversingLabs: Detection: 27%
Multi AV Scanner detection for submitted file
Source: SWIFT COPY.pdf.exe Virustotal: Detection: 27% Perma Link
Source: SWIFT COPY.pdf.exe ReversingLabs: Detection: 27%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\bSlxGzdE.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SWIFT COPY.pdf.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 3.1.SWIFT COPY.pdf.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 3.2.SWIFT COPY.pdf.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: SWIFT COPY.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: SWIFT COPY.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: mscorrc.pdb source: SWIFT COPY.pdf.exe, 00000000.00000002.651791901.0000000004A10000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 0_2_05921D00

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 192.185.171.219 192.185.171.219
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_009EA09A recv, 3_2_009EA09A
Source: unknown DNS traffic detected: queries for: mail.esquiresweaters.com
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp String found in binary or memory: http://hcVzVgyZjXO8egOI.net
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp String found in binary or memory: http://hsfZEB.com
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: SWIFT COPY.pdf.exe String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SWIFT COPY.pdf.exe Jump to behavior
Creates a DirectInput object (often for capturing keystrokes)
Source: SWIFT COPY.pdf.exe, 00000000.00000002.650618074.00000000008F0000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
.NET source code contains very large array initializations
Source: 3.1.SWIFT COPY.pdf.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b9A568286u002dB76Au002d4BC4u002d95DAu002dFD4302A7CF0Bu007d/B73E2BD9u002d65FCu002d4CE0u002dA6E2u002dC104494B7D90.cs Large array initialization: .cctor: array initializer size 12000
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: SWIFT COPY.pdf.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_0239113E NtQuerySystemInformation, 0_2_0239113E
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_0239110D NtQuerySystemInformation, 0_2_0239110D
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_009EB0BA NtQuerySystemInformation, 3_2_009EB0BA
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_009EB089 NtQuerySystemInformation, 3_2_009EB089
Detected potential crypto function
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_00128014 0_2_00128014
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_00122050 0_2_00122050
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EE480 0_2_008EE480
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E2080 0_2_008E2080
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EE0B8 0_2_008EE0B8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E3D38 0_2_008E3D38
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EDD68 0_2_008EDD68
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EEAB0 0_2_008EEAB0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E0AC8 0_2_008E0AC8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E12F0 0_2_008E12F0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EEE18 0_2_008EEE18
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E4BB8 0_2_008E4BB8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E17B0 0_2_008E17B0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E1BE8 0_2_008E1BE8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E2BF8 0_2_008E2BF8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E33F8 0_2_008E33F8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E6F50 0_2_008E6F50
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EA8E0 0_2_008EA8E0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E701C 0_2_008E701C
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E3868 0_2_008E3868
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E207A 0_2_008E207A
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E3878 0_2_008E3878
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E6988 0_2_008E6988
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E0D9F 0_2_008E0D9F
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E7998 0_2_008E7998
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E7997 0_2_008E7997
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EC9A0 0_2_008EC9A0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E21D5 0_2_008E21D5
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E15D0 0_2_008E15D0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EBDE8 0_2_008EBDE8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E15E0 0_2_008E15E0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E3D28 0_2_008E3D28
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EA940 0_2_008EA940
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E5960 0_2_008E5960
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E6961 0_2_008E6961
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E5970 0_2_008E5970
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EAEA0 0_2_008EAEA0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E0AB8 0_2_008E0AB8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E4AC8 0_2_008E4AC8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EAEE0 0_2_008EAEE0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E6650 0_2_008E6650
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E6660 0_2_008E6660
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E5798 0_2_008E5798
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E17A0 0_2_008E17A0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E5BD8 0_2_008E5BD8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E63D8 0_2_008E63D8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E33E8 0_2_008E33E8
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E4B0C 0_2_008E4B0C
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E2B4D 0_2_008E2B4D
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E6F40 0_2_008E6F40
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E6B68 0_2_008E6B68
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E6B63 0_2_008E6B63
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008EBB70 0_2_008EBB70
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_059218AD 0_2_059218AD
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_0592029D 0_2_0592029D
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_059219E6 0_2_059219E6
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_05920202 0_2_05920202
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_05920006 0_2_05920006
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_0592024E 0_2_0592024E
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_05920070 0_2_05920070
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_00E58440 3_2_00E58440
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_00E57928 3_2_00E57928
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_00E58A68 3_2_00E58A68
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_054F9D58 3_2_054F9D58
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_054F59E0 3_2_054F59E0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_054F1BB0 3_2_054F1BB0
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_054FF460 3_2_054FF460
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_054FC880 3_2_054FC880
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_054FF4A8 3_2_054FF4A8
Sample file is different than original file name gathered from version info
Source: SWIFT COPY.pdf.exe, 00000000.00000002.650305500.00000000001CA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSerializationMask.exeP vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamecqJulhxlUbeYTFCQVbjWm.exe4 vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651583507.0000000003A96000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll@ vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000000.00000002.652984206.0000000005640000.00000002.00000001.sdmp Binary or memory string: System.OriginalFileName vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651791901.0000000004A10000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000000.00000002.653230553.0000000005740000.00000002.00000001.sdmp Binary or memory string: originalfilename vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000000.00000002.653230553.0000000005740000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651146949.00000000028C1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll( vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000000.00000002.650618074.00000000008F0000.00000004.00000020.sdmp Binary or memory string: OriginalFilenamemscorwks.dllT vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe Binary or memory string: OriginalFilename vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000003.00000001.650056803.0000000000402000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamecqJulhxlUbeYTFCQVbjWm.exe4 vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000003.00000000.649325771.00000000004AA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSerializationMask.exeP vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000003.00000002.909009189.0000000004E80000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe, 00000003.00000002.906804015.0000000000BEA000.00000004.00000020.sdmp Binary or memory string: OriginalFilenamemscorwks.dllT vs SWIFT COPY.pdf.exe
Source: SWIFT COPY.pdf.exe Binary or memory string: OriginalFilenameSerializationMask.exeP vs SWIFT COPY.pdf.exe
Uses 32bit PE files
Source: SWIFT COPY.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: SWIFT COPY.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: bSlxGzdE.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 3.1.SWIFT COPY.pdf.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.1.SWIFT COPY.pdf.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@6/4@1/1
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_02390FC2 AdjustTokenPrivileges, 0_2_02390FC2
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_02390F8B AdjustTokenPrivileges, 0_2_02390F8B
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_009EAF3E AdjustTokenPrivileges, 3_2_009EAF3E
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_009EAF07 AdjustTokenPrivileges, 3_2_009EAF07
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File created: C:\Users\user\AppData\Roaming\bSlxGzdE.exe Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4296:120:WilError_01
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File created: C:\Users\user\AppData\Local\Temp\tmp15D1.tmp Jump to behavior
Source: SWIFT COPY.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
Source: SWIFT COPY.pdf.exe Virustotal: Detection: 27%
Source: SWIFT COPY.pdf.exe ReversingLabs: Detection: 27%
Source: SWIFT COPY.pdf.exe String found in binary or memory: ^(Male|Female)$-Add Student Details :-
Source: SWIFT COPY.pdf.exe String found in binary or memory: Teacher Name-Add Teacher Details :-
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File read: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SWIFT COPY.pdf.exe 'C:\Users\user\Desktop\SWIFT COPY.pdf.exe'
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\bSlxGzdE' /XML 'C:\Users\user\AppData\Local\Temp\tmp15D1.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process created: C:\Users\user\Desktop\SWIFT COPY.pdf.exe C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\bSlxGzdE' /XML 'C:\Users\user\AppData\Local\Temp\tmp15D1.tmp' Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process created: C:\Users\user\Desktop\SWIFT COPY.pdf.exe C:\Users\user\Desktop\SWIFT COPY.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: SWIFT COPY.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: SWIFT COPY.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: mscorrc.pdb source: SWIFT COPY.pdf.exe, 00000000.00000002.651791901.0000000004A10000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E982C push edx; ret 0_2_008E982E
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E0C6F push dword ptr [ebp+eax-18h]; ret 0_2_008E0C73
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 0_2_008E320A pushfd ; iretd 0_2_008E3211
Source: initial sample Static PE information: section name: .text entropy: 7.61635916813
Source: initial sample Static PE information: section name: .text entropy: 7.61635916813

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File created: C:\Users\user\AppData\Roaming\bSlxGzdE.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\bSlxGzdE' /XML 'C:\Users\user\AppData\Local\Temp\tmp15D1.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: SWIFT COPY.pdf.exe
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT COPY.pdf.exe PID: 4800, type: MEMORY
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Function Chain: systemQueried,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,systemQueried,threadDelayed,systemQueried,threadDelayed,systemQueried,threadDelayed,threadDelayed,memAlloc,systemQueried,threadDelayed,threadDelayed,threadDelayed,processSet,processSet,memAlloc,memAlloc,memAlloc,memAlloc
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Window / User API: threadDelayed 673 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe TID: 4732 Thread sleep time: -100275s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe TID: 5108 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe TID: 5648 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe TID: 5648 Thread sleep count: 673 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe TID: 5648 Thread sleep time: -20190000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe TID: 5648 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Thread delayed: delay time: 100275 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Thread delayed: delay time: 30000 Jump to behavior
Source: SWIFT COPY.pdf.exe, 00000003.00000002.909009189.0000000004E80000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: vmware
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SWIFT COPY.pdf.exe, 00000003.00000002.906871779.0000000000C5B000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: SWIFT COPY.pdf.exe, 00000003.00000002.909009189.0000000004E80000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: SWIFT COPY.pdf.exe, 00000003.00000002.909009189.0000000004E80000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: SWIFT COPY.pdf.exe, 00000003.00000002.909009189.0000000004E80000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Code function: 3_2_00E53A68 LdrInitializeThunk, 3_2_00E53A68
Enables debug privileges
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Memory written: C:\Users\user\Desktop\SWIFT COPY.pdf.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\bSlxGzdE' /XML 'C:\Users\user\AppData\Local\Temp\tmp15D1.tmp' Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Process created: C:\Users\user\Desktop\SWIFT COPY.pdf.exe C:\Users\user\Desktop\SWIFT COPY.pdf.exe Jump to behavior
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907009056.0000000001200000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907009056.0000000001200000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907009056.0000000001200000.00000002.00000001.sdmp Binary or memory string: Progman
Source: SWIFT COPY.pdf.exe, 00000003.00000002.907009056.0000000001200000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000003.00000002.906433555.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.650056803.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.651416381.00000000038C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.SWIFT COPY.pdf.exe.39dcc38.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT COPY.pdf.exe.39dcc38.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SWIFT COPY.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.SWIFT COPY.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Yara detected AgentTesla
Source: Yara match File source: 00000003.00000002.906433555.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.650056803.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.651416381.00000000038C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT COPY.pdf.exe PID: 4800, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT COPY.pdf.exe PID: 1372, type: MEMORY
Source: Yara match File source: 0.2.SWIFT COPY.pdf.exe.39dcc38.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT COPY.pdf.exe.39dcc38.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SWIFT COPY.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.SWIFT COPY.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT COPY.pdf.exe PID: 1372, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000003.00000002.906433555.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.650056803.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.651416381.00000000038C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.SWIFT COPY.pdf.exe.39dcc38.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT COPY.pdf.exe.39dcc38.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SWIFT COPY.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.SWIFT COPY.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Yara detected AgentTesla
Source: Yara match File source: 00000003.00000002.906433555.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.650056803.0000000000402000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.651416381.00000000038C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT COPY.pdf.exe PID: 4800, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT COPY.pdf.exe PID: 1372, type: MEMORY
Source: Yara match File source: 0.2.SWIFT COPY.pdf.exe.39dcc38.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT COPY.pdf.exe.39dcc38.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.SWIFT COPY.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.SWIFT COPY.pdf.exe.400000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 412589 Sample: SWIFT COPY.pdf.exe Startdate: 12/05/2021 Architecture: WINDOWS Score: 100 29 Found malware configuration 2->29 31 Multi AV Scanner detection for dropped file 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 14 other signatures 2->35 7 SWIFT COPY.pdf.exe 7 2->7         started        process3 file4 19 C:\Users\user\AppData\Roaming\bSlxGzdE.exe, PE32 7->19 dropped 21 C:\Users\...\bSlxGzdE.exe:Zone.Identifier, ASCII 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmp15D1.tmp, XML 7->23 dropped 25 C:\Users\user\...\SWIFT COPY.pdf.exe.log, ASCII 7->25 dropped 37 Injects a PE file into a foreign processes 7->37 11 SWIFT COPY.pdf.exe 4 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 27 mail.esquiresweaters.com 192.185.171.219, 49731, 587 UNIFIEDLAYER-AS-1US United States 11->27 39 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->39 41 Tries to steal Mail credentials (via file access) 11->41 43 Tries to harvest and steal ftp login credentials 11->43 45 2 other signatures 11->45 17 conhost.exe 15->17         started        signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.185.171.219
 mail.esquiresweaters.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
mail.esquiresweaters.com 192.185.171.219 true