Windows Analysis Report T-T Swift Copy.exe

Overview

General Information

Sample Name: T-T Swift Copy.exe
Analysis ID: 510295
MD5: a3127d76c37d53a8ecaab821ce5d99a6
SHA1: fe6529ff55514634d6cde730e4c4c5b664b02ccf
SHA256: d9ca56d191efaa8ac5beee52f508082d6e8efb29045bb61c23851537982fa6bf
Tags: exe
Infos:

Most interesting Screenshot:

Detection

DBatLoader FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Yara detected DBatLoader
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: Execution from Suspicious Folder
Maps a DLL or memory area into another process
Writes to foreign memory regions
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
PE file contains strange resources
Drops PE files
Uses code obfuscation techniques (call, push, ret)
Checks if the current process is being debugged
Found potential string decryption / allocating functions
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Enables debug privileges

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.ehawkstech.com/s4mt/"], "decoy": ["deviousrofwft.xyz", "iphone13.photos", "cameraderie.info", "flogotwheelz.com", "lunasconstructionllc.com", "unameofficial.com", "digitalboat.cloud", "hifi-cans.com", "breskizci.com", "kyleandconner.com", "punnyaseva.com", "elitephotoedit.com", "pizzatallrikar.one", "espacio40.com", "bvgsf.xyz", "splootingcorgi.com", "metaverse360.biz", "xnegbuy.com", "buysubarus.com", "optophonia.com", "jingcai16.com", "verdantpor.xyz", "mandyfarricker.com", "affiliategang.com", "chemissimo.com", "myspecialgift4you.com", "21cfintech.com", "parsvivid.com", "ufabetkhmer.net", "litunity.com", "bcwis.com", "ekokosiarki.com", "expocanna.net", "shanichara.com", "brightstarlogisticss.com", "intaom.net", "petshop.zone", "habxgg.com", "taiqen.com", "vehiculosvivienda.com", "igsc-eg.com", "jfhy88.com", "circuspolitician.com", "etxperiodontics.com", "wsxkd.com", "abosasaio.com", "magnacursos.online", "indigenousjobs.net", "digital904.com", "pp-jm.com", "hkqlxc.com", "mygutimautpribuinrop.com", "cosplayharem.com", "jsxybq.com", "fieldstationlodges.com", "ggrow-hairsalon.com", "aureliemorgane.com", "yian-ho.com", "woruke.club", "meet-hamburg.com", "leadergaterealty.com", "choitokki.com", "cfweb.tools", "loveyopu.com"]}
Yara detected FormBook
Source: Yara match File source: 17.0.mobsync.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.476572869.0000000006D0E000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.407026308.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.406606133.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.405354552.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Multi AV Scanner detection for dropped file
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe ReversingLabs: Detection: 38%
Antivirus or Machine Learning detection for unpacked file
Source: 17.0.mobsync.exe.72480000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.0.mobsync.exe.72480000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.0.mobsync.exe.72480000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.0.mobsync.exe.72480000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: T-T Swift Copy.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.ehawkstech.com/s4mt/
Source: unknown DNS traffic detected: queries for: onedrive.live.com

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 17.0.mobsync.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.476572869.0000000006D0E000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.407026308.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.406606133.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.405354552.0000000072480000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 17.0.mobsync.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.mobsync.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mobsync.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.mobsync.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mobsync.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.mobsync.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mobsync.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.mobsync.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mobsync.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.mobsync.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mobsync.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.mobsync.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mobsync.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.mobsync.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.mobsync.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.mobsync.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000000.476572869.0000000006D0E000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000012.00000000.476572869.0000000006D0E000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.407026308.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.407026308.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.406606133.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.406606133.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.405354552.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.405354552.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: T-T Swift Copy.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
Yara signature match
Source: 17.0.mobsync.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.mobsync.exe.72480000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mobsync.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.mobsync.exe.72480000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mobsync.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.mobsync.exe.72480000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mobsync.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.mobsync.exe.72480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mobsync.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.mobsync.exe.72480000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mobsync.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.mobsync.exe.72480000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mobsync.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.mobsync.exe.72480000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.mobsync.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.mobsync.exe.72480000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000000.522824405.000000000DDB9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 00000012.00000000.476572869.0000000006D0E000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000012.00000000.476572869.0000000006D0E000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.407026308.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.407026308.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.406606133.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.406606133.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.405354552.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.405354552.0000000072480000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\Public\Libraries\owgkuB.url, type: DROPPED Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
PE file contains strange resources
Source: T-T Swift Copy.exe Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Bukgwo.exe.0.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Found potential string decryption / allocating functions
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Code function: String function: 0270A454 appears 32 times
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Code function: String function: 0270D424 appears 48 times
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Code function: String function: 021FAAB8 appears 64 times
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Code function: String function: 0270837C appears 80 times
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Code function: String function: 021F837C appears 80 times
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Code function: String function: 021FD424 appears 48 times
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: String function: 0234D424 appears 36 times
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory allocated: 72480000 page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory allocated: 72480000 page no access Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory allocated: 72480000 page read and write Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory allocated: 72481000 page read and write Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe File read: C:\Users\user\Desktop\T-T Swift Copy.exe Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\T-T Swift Copy.exe 'C:\Users\user\Desktop\T-T Swift Copy.exe'
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe 'C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe'
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe 'C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe'
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe 'C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe' Jump to behavior
Source: T-T Swift Copy.exe Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\Bukgwonqgngtrpkjastfgihmnxlmffz[1] Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@6/3@4/1
Source: C:\Users\user\Desktop\T-T Swift Copy.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: T-T Swift Copy.exe Static file information: File size 1052672 > 1048576

Data Obfuscation:

barindex
Yara detected DBatLoader
Source: Yara match File source: 00000015.00000002.520675116.00000000021A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.521099997.00000000026B0000.00000004.00000001.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A584 push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_0234A58E push eax; ret 0_3_0234A5C0

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\T-T Swift Copy.exe File created: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Jump to dropped file
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Bukgwo Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Bukgwo Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\SysWOW64\mobsync.exe RDTSC instruction interceptor: First address: 0000000072488604 second address: 000000007248860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mobsync.exe RDTSC instruction interceptor: First address: 000000007248898E second address: 0000000072488994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mobsync.exe Process information queried: ProcessInformation Jump to behavior
Source: explorer.exe, 00000012.00000000.427677045.0000000008AEA000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000012.00000000.430733448.000000000DD50000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000012.00000000.414140722.0000000003710000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000012.00000000.461548736.0000000003767000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000012.00000002.532156882.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000012.00000000.495160737.0000000008AB2000.00000004.00000001.sdmp Binary or memory string: Prod_VMware_SATA-6
Source: explorer.exe, 00000012.00000000.491525429.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000012.00000000.464859424.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000012.00000000.491525429.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\mobsync.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Code function: 0_3_02349EE0 LdrInitializeThunk, 0_3_02349EE0
Enables debug privileges
Source: C:\Windows\SysWOW64\mobsync.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\mobsync.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory written: C:\Windows\SysWOW64\mobsync.exe base: 72480000 Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory written: C:\Windows\SysWOW64\mobsync.exe base: 1000000 Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory written: C:\Windows\SysWOW64\mobsync.exe base: 1010000 Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 1010000 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 72480000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 1000000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 1010000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Memory written: C:\Windows\SysWOW64\mobsync.exe base: 72480000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\T-T Swift Copy.exe Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe Jump to behavior
Source: explorer.exe, 00000012.00000000.427087654.00000000089FF000.00000004.00000001.sdmp, Bukgwo.exe, 00000015.00000002.519902050.0000000000D50000.00000002.00020000.sdmp, Bukgwo.exe, 00000018.00000002.519458391.0000000000E60000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000012.00000000.450521833.0000000001640000.00000002.00020000.sdmp, Bukgwo.exe, 00000015.00000002.519902050.0000000000D50000.00000002.00020000.sdmp, Bukgwo.exe, 00000018.00000002.519458391.0000000000E60000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000012.00000000.450521833.0000000001640000.00000002.00020000.sdmp, Bukgwo.exe, 00000015.00000002.519902050.0000000000D50000.00000002.00020000.sdmp, Bukgwo.exe, 00000018.00000002.519458391.0000000000E60000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000012.00000000.448726082.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000012.00000000.450521833.0000000001640000.00000002.00020000.sdmp, Bukgwo.exe, 00000015.00000002.519902050.0000000000D50000.00000002.00020000.sdmp, Bukgwo.exe, 00000018.00000002.519458391.0000000000E60000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000012.00000000.450521833.0000000001640000.00000002.00020000.sdmp, Bukgwo.exe, 00000015.00000002.519902050.0000000000D50000.00000002.00020000.sdmp, Bukgwo.exe, 00000018.00000002.519458391.0000000000E60000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 17.0.mobsync.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.476572869.0000000006D0E000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.407026308.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.406606133.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.405354552.0000000072480000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 17.0.mobsync.exe.72480000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.mobsync.exe.72480000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.476572869.0000000006D0E000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.406123178.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.407026308.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.406606133.0000000072480000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.405354552.0000000072480000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 510295 Sample: T-T Swift Copy.exe Startdate: 27/10/2021 Architecture: WINDOWS Score: 100 27 onedrive.live.com 2->27 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Yara detected DBatLoader 2->41 43 3 other signatures 2->43 9 T-T Swift Copy.exe 1 18 2->9         started        signatures3 process4 dnsIp5 31 vhpf4g.bn.files.1drv.com 9->31 33 onedrive.live.com 9->33 35 bn-files.fe.1drv.com 9->35 25 C:\Users\Public\Libraries\Bukgwo\Bukgwo.exe, PE32 9->25 dropped 47 Writes to foreign memory regions 9->47 49 Allocates memory in foreign processes 9->49 51 Creates a thread in another existing process (thread injection) 9->51 53 Injects a PE file into a foreign processes 9->53 14 mobsync.exe 9->14         started        file6 signatures7 process8 signatures9 55 Maps a DLL or memory area into another process 14->55 57 Tries to detect virtualization through RDTSC time measurements 14->57 17 explorer.exe 2 14->17 injected process10 process11 19 Bukgwo.exe 17->19         started        23 Bukgwo.exe 17->23         started        dnsIp12 29 192.168.2.1 unknown unknown 19->29 45 Multi AV Scanner detection for dropped file 19->45 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
onedrive.live.com unknown unknown
vhpf4g.bn.files.1drv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.ehawkstech.com/s4mt/ true
  • Avira URL Cloud: safe
 low