File name:

swift-bootstrapper.exe

Full analysis: https://app.any.run/tasks/ef0a7fc3-ca1c-4ca1-80bb-1dccc1ab10ce
Verdict: Malicious activity
Analysis date: December 31, 2024, 06:49:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
generic
github
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 5 sections
MD5:

26E350B6F17A777A79B8BE46E1B06AC0

SHA1:

ACDBBEF171B2361604BB7678645ACF62FC2CC7AF

SHA256:

29C535C85CA221059C46B364B9B6A81E68A0E0A6AEF5DA460DCB0DADDF90D2F1

SSDEEP:

98304:9HSxyqAQYZCPUOdLT5W0rQlKW0AKP7k3ApjBYEQ3jd60roAKCuEJQMUpEPd9B/NX:JI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • swift-bootstrapper.exe (PID: 5720)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • swift-bootstrapper.exe (PID: 5720)

  • INFO

    • Checks proxy server information

      • swift-bootstrapper.exe (PID: 5720)

    • Reads the computer name

      • swift-bootstrapper.exe (PID: 5720)

    • Checks supported languages

      • swift-bootstrapper.exe (PID: 5720)

    • Reads the software policy settings

      • swift-bootstrapper.exe (PID: 5720)

    • Create files in a temporary directory

      • swift-bootstrapper.exe (PID: 5720)

    • Application based on Rust

      • swift-bootstrapper.exe (PID: 5720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:12:06 18:09:31+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 4163072
InitializedDataSize: 1816064
UninitializedDataSize: -
EntryPoint: 0x3f65a0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start swift-bootstrapper.exe conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—swift-bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5236"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5720"C:\Users\admin\AppData\Local\Temp\swift-bootstrapper.exe" C:\Users\admin\AppData\Local\Temp\swift-bootstrapper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\swift-bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
782
Read events
782
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5720swift-bootstrapper.exeC:\Users\admin\AppData\Local\Temp\Swift.exeexecutable
MD5:64B0517790437B071FEF6CD6782D4B9F
SHA256:E12D17C65A31989079774E3E465178CDD9FB5D07E101D4654BDF8EA618F6B1F5
5720swift-bootstrapper.exeC:\Users\admin\AppData\Local\Temp\bin\injector.exeexecutable
MD5:A5CCAEC11B613A44116B6EFF8230664A
SHA256:07409D4ADC7D4F9DB6AD642C1D7F989C69516F0B356214A8C1C1E6BB58F43EF4
5720swift-bootstrapper.exeC:\Users\admin\AppData\Local\Temp\bin\Dll3.dllexecutable
MD5:1C10CC2A3331CDE56573063B0EA6CC4F
SHA256:3BFD55ACBD4AB748EB7559E7944993D9D6E05F84A5440BF2E536215079CC0F34
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
51
DNS requests
22
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6160
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6952
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6952
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4992
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3976
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5720
swift-bootstrapper.exe
128.116.123.4:443
clientsettings.roblox.com
ROBLOX-PRODUCTION
US
whitelisted
5720
swift-bootstrapper.exe
188.114.96.3:443
bunni.lol
CLOUDFLARENET
NL
unknown
5720
swift-bootstrapper.exe
140.82.121.3:443
github.com
GITHUB
US
shared

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.174
whitelisted
clientsettings.roblox.com
  • 128.116.123.4
whitelisted
bunni.lol
  • 188.114.96.3
  • 188.114.97.3
unknown
github.com
  • 140.82.121.3
shared
www.bing.com
  • 2.23.209.193
  • 2.23.209.189
  • 2.23.209.177
  • 2.23.209.130
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.187
whitelisted
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.111.133
shared
login.live.com
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.69
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
swift-bootstrapper.exe