281da6e00a1e62346cb302ac1756b594f956d16eb658ab3cfae6332482539b7d

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc548713a947afc05890c206d6b63ac8_JC.exe
Size

161KB
MD5

bc548713a947afc05890c206d6b63ac8
SHA1

338447d5e4da7f3956a1a497b4b4117cf028a596
SHA256

281da6e00a1e62346cb302ac1756b594f956d16eb658ab3cfae6332482539b7d
SHA512

9d7e0e178a90f59b2b31f6d4586c9068994a91ad32a7d09d7a86d684ebbef11af96087435cc953335da57e0012d80a62baa87ba3902ef86761f2ab009bb037c6
SSDEEP

3072:aKcWmjRrz3/spWvv6RwYLV2EPr1oMBGd1D2S+eBalODap:ZGWSjk2EPr1oFkSrBalODM

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1620	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3424-0-0x0000000000E40000-0x0000000000E68000-memory.dmp	upx
behavioral2/memory/3424-3-0x0000000000E40000-0x0000000000E68000-memory.dmp	upx
behavioral2/memory/1620-8-0x0000000000850000-0x0000000000878000-memory.dmp	upx
behavioral2/memory/3424-10-0x0000000000E40000-0x0000000000E68000-memory.dmp	upx
behavioral2/files/0x000200000002288b-9.dat	upx
behavioral2/files/0x000200000002288b-7.dat	upx
behavioral2/files/0x00050000000226ea-13.dat	upx
behavioral2/files/0x000800000002320d-30.dat	upx
behavioral2/memory/1620-32-0x0000000000850000-0x0000000000878000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	bc548713a947afc05890c206d6b63ac8_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	bc548713a947afc05890c206d6b63ac8_JC.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	bc548713a947afc05890c206d6b63ac8_JC.exe
Token: SeDebugPrivilege	1620	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 1620	3424	bc548713a947afc05890c206d6b63ac8_JC.exe	83
PID 3424 wrote to memory of 1620	3424	bc548713a947afc05890c206d6b63ac8_JC.exe	83
PID 3424 wrote to memory of 1620	3424	bc548713a947afc05890c206d6b63ac8_JC.exe	83

C:\Users\Admin\AppData\Local\Temp\bc548713a947afc05890c206d6b63ac8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\bc548713a947afc05890c206d6b63ac8_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
484KB

MD5
0ccb55f982fbf0c84a0eab280698c214

SHA1
abfa80959373b5d9f2759bc7922cbcedff63fcf0

SHA256
d54a373f9f77e1e22e9c44f578f70686cbdcca1cefd84ad890b2360085ddfb8b

SHA512
30a77c71d5099d0c1178bdd848662c23f6b54b0ca828ea9014b37f48c25f73d18e52eac8e10158d01c100f0f8efc5f5989e339d672a270be2acc0487132c4a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\KcNEN0z3RCSI1RA.exe

Filesize
161KB

MD5
433b4676a85e35c94bce9abd6bf05c8d

SHA1
123c68bdf4d7efc258f48cff03c524a7ae831a8f

SHA256
22334b216d1bdb1ea6f595eac7bcacbf6215ace596100164f93b51a028042a84

SHA512
7fd2f8e2a1cb922cc6d37f06aca278e96e7d1faf0efbfe554546630bee1e87a031fb62ee1efc754ecd6eecc7fb98fcd6ac6d46deadca7e68170ab43f374bf4ca

Download Submit
C:\Windows\CTS.exe

Filesize
161KB

MD5
e8f8a485ab339763f170f82d68d4107d

SHA1
460dad0367cb4cdc47abd3c56f08f93693aff1c9

SHA256
371b30e5623c6337ad98c420f570bc9c86878ddec314e404e570c4348554c17b

SHA512
7d22ef520543c5f7b7f0d816a0eaabcf093a03c96de2a002d035d3eb0d27abcff9dfcfa88113bcf2b51a5eb638c4b39c35c031054a3a4314e4c1190928d240f5

Download Submit
C:\Windows\CTS.exe

Filesize
161KB

MD5
e8f8a485ab339763f170f82d68d4107d

SHA1
460dad0367cb4cdc47abd3c56f08f93693aff1c9

SHA256
371b30e5623c6337ad98c420f570bc9c86878ddec314e404e570c4348554c17b

SHA512
7d22ef520543c5f7b7f0d816a0eaabcf093a03c96de2a002d035d3eb0d27abcff9dfcfa88113bcf2b51a5eb638c4b39c35c031054a3a4314e4c1190928d240f5

Download Submit
memory/1620-8-0x0000000000850000-0x0000000000878000-memory.dmp

Filesize
160KB

Download
memory/1620-32-0x0000000000850000-0x0000000000878000-memory.dmp

Filesize
160KB

Download
memory/3424-0-0x0000000000E40000-0x0000000000E68000-memory.dmp

Filesize
160KB

Download
memory/3424-3-0x0000000000E40000-0x0000000000E68000-memory.dmp

Filesize
160KB

Download
memory/3424-10-0x0000000000E40000-0x0000000000E68000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads