Windows Analysis Report
SWIFT TRANSFER.exe

Overview

General Information

Sample Name: SWIFT TRANSFER.exe
Analysis ID: 680490
MD5: 735ee862055fcbcc574b73b1695af599
SHA1: a4438d8649da60b9ed19aa5d98962dc1de1efa3a
SHA256: b496205d5045c9c9f9407bfca6a4c9088218560c2884fd737c8efe76352ae3ca
Tags: agentteslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SWIFT TRANSFER.exe ReversingLabs: Detection: 37%
Machine Learning detection for sample
Source: SWIFT TRANSFER.exe Joe Sandbox ML: detected
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "marketing9@activandalucia.com", "Password": "iyke123456789@$", "Host": "mail.activandalucia.com"}
Uses 32bit PE files
Source: SWIFT TRANSFER.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SWIFT TRANSFER.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: System.Core.ni.pdbRSDSD source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb( source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdb|M source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Management.pdb8 source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: i,C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Desktop\SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: .pdb) source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.pdbE source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Configuration.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000002.329259032.0000000001280000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.310573186.0000000001280000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: CustomMarshalers.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Core.ni.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Users\user\Desktop\SWIFT TRANSFER.PDBay- source: SWIFT TRANSFER.exe, 00000004.00000000.303998535.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000002.329297686.0000000001297000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\dll\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Management.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Core.pdb| source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Core.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: CustomMarshalers.pdbCA source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Xml.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.ni.pdb source: WERBDDB.tmp.dmp.15.dr

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49744 -> 185.162.171.75:587
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49744 -> 185.162.171.75:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49744 -> 185.162.171.75:587
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ASN-XTUDIONETES ASN-XTUDIONETES
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.162.171.75 185.162.171.75
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49744 -> 185.162.171.75:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.3:49744 -> 185.162.171.75:587
Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidPsi/Psi
Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.307429408.00000000031D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://TWzBs3cIiDHX5nVtjxF.com
Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://activandalucia.com
Source: SWIFT TRANSFER.exe, 00000000.00000003.247217501.00000000057B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.activandalucia.com
Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ohMkNy.com
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com6
Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comFN
Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comFc
Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsa
Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsd
Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd
Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.come.com
Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.268803149.00000000057B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coml1
Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.como
Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.como$
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cF
Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248581922.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cncro
Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cns-e
Source: SWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnz
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SWIFT TRANSFER.exe, 00000000.00000003.255063791.00000000057E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/U
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/$
Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//$
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/6
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/N
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/P
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/j
Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/G
Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/u
Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/u
Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247410435.00000000057CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com#
Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.come
Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.comt
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%
Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%facebooktwittergmailinstagrammovieskypepornhackwhatsappdiscordemailpassword%st
Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: mail.activandalucia.com
Creates a DirectInput object (often for capturing keystrokes)
Source: SWIFT TRANSFER.exe, 00000000.00000002.269297304.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands
barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Uses 32bit PE files
Source: SWIFT TRANSFER.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
One or more processes crash
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700
Detected potential crypto function
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Code function: 0_2_04CFCD04 0_2_04CFCD04
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Code function: 0_2_04CFF0D0 0_2_04CFF0D0
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Code function: 0_2_05299BB0 0_2_05299BB0
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Code function: 0_2_05299B9F 0_2_05299B9F
Sample file is different than original file name gathered from version info
Source: SWIFT TRANSFER.exe, 00000000.00000002.285789862.00000000070B0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameDoncepre.dll@ vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000000.243752092.00000000004E2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSoapParameterAttrib.exeB vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDoncepre.dll@ vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000002.270431587.000000000293B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebName.dll4 vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000003.259589583.0000000000D19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameKeysNormalize.dll4 vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000002.269297304.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000002.285119359.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameKeysNormalize.dll4 vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000000.00000002.285393726.0000000006F40000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameWebName.dll4 vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000004.00000000.303386378.00000000011FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe, 00000004.00000000.267496263.0000000000438000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe Binary or memory string: OriginalFilenameSoapParameterAttrib.exeB vs SWIFT TRANSFER.exe
Source: SWIFT TRANSFER.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SWIFT TRANSFER.exe ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File read: C:\Users\user\Desktop\SWIFT TRANSFER.exe Jump to behavior
Source: SWIFT TRANSFER.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SWIFT TRANSFER.exe "C:\Users\user\Desktop\SWIFT TRANSFER.exe"
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exe
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exe Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT TRANSFER.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDDB.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@4/6@2/1
Source: SWIFT TRANSFER.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5752
Source: SWIFT TRANSFER.exe, ProcExpGUI/Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.SWIFT TRANSFER.exe.4e0000.0.unpack, ProcExpGUI/Form1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: SWIFT TRANSFER.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SWIFT TRANSFER.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: System.Core.ni.pdbRSDSD source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb( source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdb|M source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Management.pdb8 source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: i,C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\Desktop\SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: .pdb) source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.pdbE source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Configuration.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000002.329259032.0000000001280000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.310573186.0000000001280000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: CustomMarshalers.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Core.ni.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Users\user\Desktop\SWIFT TRANSFER.PDBay- source: SWIFT TRANSFER.exe, 00000004.00000000.303998535.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000002.329297686.0000000001297000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\dll\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Management.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Core.pdb| source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Core.pdb source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: CustomMarshalers.pdbCA source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.Xml.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
Source: Binary string: System.ni.pdb source: WERBDDB.tmp.dmp.15.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: SWIFT TRANSFER.exe, ProcExpGUI/Form1.cs .Net Code: WaitHandle System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.SWIFT TRANSFER.exe.4e0000.0.unpack, ProcExpGUI/Form1.cs .Net Code: WaitHandle System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Code function: 0_2_0529AC38 push eax; ret 0_2_0529AC39
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Code function: 0_2_0529AC90 pushfd ; ret 0_2_0529AC91
Source: initial sample Static PE information: section name: .text entropy: 7.792812997909333
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SWIFT TRANSFER.exe, 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: SWIFT TRANSFER.exe, 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 6028 Thread sleep time: -45877s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 5888 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 5364 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 1008 Thread sleep count: 9589 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Window / User API: threadDelayed 9589 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Thread delayed: delay time: 45877 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Enables debug privileges
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process token adjusted: Debug Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Memory written: C:\Users\user\Desktop\SWIFT TRANSFER.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Process created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Users\user\Desktop\SWIFT TRANSFER.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Users\user\Desktop\SWIFT TRANSFER.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680490 Sample: SWIFT TRANSFER.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 100 26 Snort IDS alert for network traffic 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 7 other signatures 2->32 7 SWIFT TRANSFER.exe 3 2->7         started        process3 file4 18 C:\Users\user\...\SWIFT TRANSFER.exe.log, ASCII 7->18 dropped 34 Injects a PE file into a foreign processes 7->34 11 SWIFT TRANSFER.exe 2 7->11         started        signatures5 process6 dnsIp7 22 activandalucia.com 185.162.171.75, 49744, 587 ASN-XTUDIONETES Spain 11->22 24 mail.activandalucia.com 11->24 20 C:\Windows\System32\drivers\etc\hosts, ASCII 11->20 dropped 36 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->36 38 Tries to steal Mail credentials (via file / registry access) 11->38 40 Tries to harvest and steal ftp login credentials 11->40 42 2 other signatures 11->42 16 WerFault.exe 23 9 11->16         started        file8 signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.162.171.75
 activandalucia.com Spain
60458 ASN-XTUDIONETES true

Contacted Domains

Name IP Active
activandalucia.com 185.162.171.75 true
mail.activandalucia.com unknown unknown