6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02

Analysis

max time kernel
141s
max time network
156s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe
Size

2.0MB
MD5

4fafff53eb3b2bffc2eecfdd47cd7a03
SHA1

8c46164f41e47a123a877590ca9d14e4dd48d5bd
SHA256

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02
SHA512

bc067942224c844aaabfa017a623c7dcf0b7ec4f55ff2f5f774b78466c1a93ca951b62930eb5ae49bfa8bd62534fd22f4edb44e8977b7c091c470732558b942a
SSDEEP

49152:dryR4nWLGC43UD41Lm79ePoyaSOT6vZFw8U:0RW+AWdgZG8U

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ctbow.exe

pid process

516 ctbow.exe

pid	process
516	ctbow.exe

Loads dropped DLL 2 IoCs

Processes:

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

pid	process
1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe
1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ÎÒµÄÆô¶¯Ïî = "C:\\Windows\\system32\\/ctbow.exe"	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

Drops file in System32 directory 1 IoCs

Processes:

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

description ioc process

File created C:\Windows\SysWOW64\ctbow.exe 6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ctbow.exe	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

pid	process
1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe
1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe
1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe
1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

ctbow.exe6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	ctbow.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "www.2345.com/?keyybc"	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

ctbow.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	ctbow.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	ctbow.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

pid process

1104 6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exectbow.exe

pid	process
1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe
1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe
516	ctbow.exe
516	ctbow.exe
516	ctbow.exe
516	ctbow.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe

description	pid	process	target process
PID 1104 wrote to memory of 516	1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe	ctbow.exe
PID 1104 wrote to memory of 516	1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe	ctbow.exe
PID 1104 wrote to memory of 516	1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe	ctbow.exe
PID 1104 wrote to memory of 516	1104	6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe	ctbow.exe

C:\Users\Admin\AppData\Local\Temp\6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe
"C:\Users\Admin\AppData\Local\Temp\6a6654b5219ad38195b61e8287d6aab356f0eca40d8e809d422d9075c66dde02.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\ctbow.exe
C:\Windows\system32\/ctbow.exe
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctbow.exe

Filesize
860KB

MD5
b2d6bacc36f7bd353333e0b420f26d40

SHA1
fc6d42b77e8d897fc5c871d89aa7a646c43a7394

SHA256
6f5451d9d64e6b0c45a17ef0f418f2d43995e2ca384786fb7ccabd49210544bc

SHA512
bb840dd25e808a434fa5934d33c64fd94ae1946412e97f72d9c6e06e3cf85d2783d9ded3cb75e38ea42671b178a45fde1124acddce286508aba6e9e0e58746a1

Download Submit
C:\Windows\SysWOW64\ctbow.exe

Filesize
860KB

MD5
b2d6bacc36f7bd353333e0b420f26d40

SHA1
fc6d42b77e8d897fc5c871d89aa7a646c43a7394

SHA256
6f5451d9d64e6b0c45a17ef0f418f2d43995e2ca384786fb7ccabd49210544bc

SHA512
bb840dd25e808a434fa5934d33c64fd94ae1946412e97f72d9c6e06e3cf85d2783d9ded3cb75e38ea42671b178a45fde1124acddce286508aba6e9e0e58746a1

Download Submit
\Windows\SysWOW64\ctbow.exe

Filesize
860KB

MD5
b2d6bacc36f7bd353333e0b420f26d40

SHA1
fc6d42b77e8d897fc5c871d89aa7a646c43a7394

SHA256
6f5451d9d64e6b0c45a17ef0f418f2d43995e2ca384786fb7ccabd49210544bc

SHA512
bb840dd25e808a434fa5934d33c64fd94ae1946412e97f72d9c6e06e3cf85d2783d9ded3cb75e38ea42671b178a45fde1124acddce286508aba6e9e0e58746a1

Download Submit
\Windows\SysWOW64\ctbow.exe

Filesize
860KB

MD5
b2d6bacc36f7bd353333e0b420f26d40

SHA1
fc6d42b77e8d897fc5c871d89aa7a646c43a7394

SHA256
6f5451d9d64e6b0c45a17ef0f418f2d43995e2ca384786fb7ccabd49210544bc

SHA512
bb840dd25e808a434fa5934d33c64fd94ae1946412e97f72d9c6e06e3cf85d2783d9ded3cb75e38ea42671b178a45fde1124acddce286508aba6e9e0e58746a1

Download Submit
memory/516-4817-0x0000000000000000-mapping.dmp

Download
memory/1104-493-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-4821-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/1104-196-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/1104-463-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-464-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-496-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-466-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-468-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-470-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-472-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-471-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-469-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-467-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-473-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-474-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-475-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-476-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-478-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-481-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-482-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-483-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-480-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-479-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-477-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-484-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-485-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-486-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-487-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-489-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-490-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-488-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-491-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-492-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1104-494-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-495-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-465-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-56-0x0000000076F30000-0x0000000076F77000-memory.dmp

Filesize
284KB

Download
memory/1104-500-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-501-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-502-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-499-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-498-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-503-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-506-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-507-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-508-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-504-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-505-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-509-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-512-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-510-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-511-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-513-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-514-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-515-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-516-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-517-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-518-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-519-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-521-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-522-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-523-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-520-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-524-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-1343-0x0000000002430000-0x00000000025B1000-memory.dmp

Filesize
1.5MB

Download
memory/1104-1342-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/1104-4430-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/1104-4820-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-497-0x0000000002270000-0x0000000002381000-memory.dmp

Filesize
1.1MB

Download
memory/1104-4822-0x00000000025C0000-0x00000000026C1000-memory.dmp

Filesize
1.0MB

Download
memory/1104-4823-0x0000000002120000-0x00000000021C1000-memory.dmp

Filesize
644KB

Download
memory/1104-4824-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download