aaf81b1bccda6e62369db3267fdcd6c72478c94ed758151f96327dcb67b6837d

Analysis

max time kernel
153s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2023 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Size

119KB
MD5

8dac60126622aa3c7dc96d3dce9e3d96
SHA1

9765a97d89eb7e9bc780774309cd859c3ff3b339
SHA256

aaf81b1bccda6e62369db3267fdcd6c72478c94ed758151f96327dcb67b6837d
SHA512

b49dca7f6eccc412a18d2e2dab7166d5ebcb1d3708d642a24ebb23416c31098c5085919f9b20e18d0c9e0055ea9ec889dca08aaf3126e0a44576fab77fa9daae
SSDEEP

3072:HOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:HIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00080000000231db-10.dat	acprotect
behavioral2/files/0x00080000000231db-29.dat	acprotect
behavioral2/files/0x00080000000231db-34.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4308	ctfmen.exe
3504	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
3064	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
3504	smnss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
File created	C:\Windows\SysWOW64\smnss.exe	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
File created	C:\Windows\SysWOW64\shervans.dll	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
File created	C:\Windows\SysWOW64\grcopy.dll	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
File created	C:\Windows\SysWOW64\satornas.dll	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	smnss.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\AUTHORS.txt	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxBlockMap.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTile.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreRating\StoreRatingRules.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x86__8wekyb3d8bbwe\MSIX\singleton_license.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML	smnss.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bn-BD\View3d\3DViewerProductDescription-universal.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lo-LA\View3d\3DViewerProductDescription-universal.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x86__8wekyb3d8bbwe\AppxBlockMap.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\README.txt	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML	smnss.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\AppxManifest.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxManifest.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\HeartbeatConfig.xml	smnss.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\3DViewerProductDescription-universal.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml	smnss.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	smnss.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	smnss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML	smnss.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml	smnss.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 4308	3064	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe	91
PID 3064 wrote to memory of 4308	3064	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe	91
PID 3064 wrote to memory of 4308	3064	NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe	91
PID 4308 wrote to memory of 3504	4308	ctfmen.exe	92
PID 4308 wrote to memory of 3504	4308	ctfmen.exe	92
PID 4308 wrote to memory of 3504	4308	ctfmen.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8dac60126622aa3c7dc96d3dce9e3d96_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
57e3bd9cd4d9fc5e26c97ee0b7a7d5f8

SHA1
ea01ea1be5042a8bcfa01f1a2eca37b6315a6400

SHA256
6ad2cb9b2dea4dc3f3f025c24937133c739fa96c26ae633910ef14514f020559

SHA512
5bdc1e88de870cad56b87d3254f49647a354d0ab3dfdbeadd494ce698bc28c1561a3b25362f7d720b7cefa5c902c2fa910737a806c3f25c78c6585074020155d

Download Submit
C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
57e3bd9cd4d9fc5e26c97ee0b7a7d5f8

SHA1
ea01ea1be5042a8bcfa01f1a2eca37b6315a6400

SHA256
6ad2cb9b2dea4dc3f3f025c24937133c739fa96c26ae633910ef14514f020559

SHA512
5bdc1e88de870cad56b87d3254f49647a354d0ab3dfdbeadd494ce698bc28c1561a3b25362f7d720b7cefa5c902c2fa910737a806c3f25c78c6585074020155d

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
119KB

MD5
5774fb04efcfcfc9cb12b8df63cd6507

SHA1
55c46be66e7ff2ed1b9f0443d98c410b0eee0cd6

SHA256
433e21744171c00d85e91352580ab846995472c792df052c4ceb713b81319f55

SHA512
1b8e28247f1b116494faee8b2734018d4deb8ba0f4bdea383800a8e4b5ebe46d2cd0077d98c517c45cc841d54199eec12d937b4d4b77dc0ecd086377acb232f7

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
119KB

MD5
5774fb04efcfcfc9cb12b8df63cd6507

SHA1
55c46be66e7ff2ed1b9f0443d98c410b0eee0cd6

SHA256
433e21744171c00d85e91352580ab846995472c792df052c4ceb713b81319f55

SHA512
1b8e28247f1b116494faee8b2734018d4deb8ba0f4bdea383800a8e4b5ebe46d2cd0077d98c517c45cc841d54199eec12d937b4d4b77dc0ecd086377acb232f7

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
acba38a3d03abe2728372c51887bbeef

SHA1
f61b85add1ededadc334a907a175c8acab95bda2

SHA256
d4494dab533cbd0e35e7be11f0800dfb3398aeb8c0f4d88486c26babca5422d2

SHA512
3cb1945eeacdb31e65a19a539a4eace34397bde029114d9d3b61832682457e917211e7664dab6cee30c3df3efa790e58c7deda4184742981b2b7ec630edea6c9

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
6ba7f59d2b1eb3c1bb6585a392f4fcb3

SHA1
f8c3f37ff6d99e33a5403c945893d9f6cd24d937

SHA256
2feb54179282ef09be502e0b13c18ac7049ed4898a61ebd423d9f93ea5a2079d

SHA512
3da90dd7ceafe0e0511f022b89648973e77b62616ccf5c250eb6370a7578d09f5239f9f3670f26130f2cf87e35903238a3c6642efc37e0da48190cd89f16921f

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
6ba7f59d2b1eb3c1bb6585a392f4fcb3

SHA1
f8c3f37ff6d99e33a5403c945893d9f6cd24d937

SHA256
2feb54179282ef09be502e0b13c18ac7049ed4898a61ebd423d9f93ea5a2079d

SHA512
3da90dd7ceafe0e0511f022b89648973e77b62616ccf5c250eb6370a7578d09f5239f9f3670f26130f2cf87e35903238a3c6642efc37e0da48190cd89f16921f

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
6ba7f59d2b1eb3c1bb6585a392f4fcb3

SHA1
f8c3f37ff6d99e33a5403c945893d9f6cd24d937

SHA256
2feb54179282ef09be502e0b13c18ac7049ed4898a61ebd423d9f93ea5a2079d

SHA512
3da90dd7ceafe0e0511f022b89648973e77b62616ccf5c250eb6370a7578d09f5239f9f3670f26130f2cf87e35903238a3c6642efc37e0da48190cd89f16921f

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
119KB

MD5
5774fb04efcfcfc9cb12b8df63cd6507

SHA1
55c46be66e7ff2ed1b9f0443d98c410b0eee0cd6

SHA256
433e21744171c00d85e91352580ab846995472c792df052c4ceb713b81319f55

SHA512
1b8e28247f1b116494faee8b2734018d4deb8ba0f4bdea383800a8e4b5ebe46d2cd0077d98c517c45cc841d54199eec12d937b4d4b77dc0ecd086377acb232f7

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
119KB

MD5
5774fb04efcfcfc9cb12b8df63cd6507

SHA1
55c46be66e7ff2ed1b9f0443d98c410b0eee0cd6

SHA256
433e21744171c00d85e91352580ab846995472c792df052c4ceb713b81319f55

SHA512
1b8e28247f1b116494faee8b2734018d4deb8ba0f4bdea383800a8e4b5ebe46d2cd0077d98c517c45cc841d54199eec12d937b4d4b77dc0ecd086377acb232f7

Download Submit
memory/3064-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3064-22-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3064-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3064-12-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3504-30-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3504-35-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3504-37-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3504-38-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4308-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4308-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads