Overview

overview

10

Static

static

10

manstealer

windows10_x64

4

Analysis

  • max time kernel
    50s
  • max time network
    54s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    17-04-2021 11:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fvansrjesrsjeyasgns.exe

  • Size

    45KB

  • MD5

    34eacbb5f987cf3711bbd2f8bbf21fea

  • SHA1

    134476f25993f9476501d15db0edf16c74166451

  • SHA256

    f658bc9b0dc3d342463f6eecae35d14d48825ac175358773c62905d6d58f5cd2

  • SHA512

    424a9652eb8eae6a197cfba3321d5068e9cec55b97dcde70dde36eb0db985f6d4c10cb5230577c5ad3ed60e801ccdd73c37e7c3f30fa273fa4f43b78310188b2

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fvansrjesrsjeyasgns.exe
    "C:\Users\Admin\AppData\Local\Temp\fvansrjesrsjeyasgns.exe"
    1⤵
      PID:632
    • C:\Windows\System32\SystemSettingsBroker.exe
      C:\Windows\System32\SystemSettingsBroker.exe -Embedding
      1⤵
        PID:3788
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
        1⤵
          PID:1248
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservice -s SstpSvc
          1⤵
            PID:2120
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:3836
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
            1⤵
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:2324
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s RasMan
            1⤵
              PID:3776

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Persistence

            Privilege Escalation

            Defense Evasion

            Credential Access

            Discovery

            Query Registry

            1
            T1012

            Peripheral Device Discovery

            1
            T1120

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\INF\netsstpa.PNF
              MD5

              01e21456e8000bab92907eec3b3aeea9

              SHA1

              39b34fe438352f7b095e24c89968fca48b8ce11c

              SHA256

              35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

              SHA512

              9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

              Download Submit
            • memory/632-114-0x0000000000470000-0x0000000000471000-memory.dmp
              Filesize

              4KB

              Download
            • memory/632-116-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
              Filesize

              4KB

              Download