1988b49750512f213f05bca7a51bc64cd59278872fb25657576b963427400e4b

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Size

119KB
MD5

0fdf2c09bb6f7036de3a580502016510
SHA1

c736459d2f33fc56fd67758ab61c549b383547ae
SHA256

1988b49750512f213f05bca7a51bc64cd59278872fb25657576b963427400e4b
SHA512

01437b1234757becb0d9491a81761e2f1ca85e8d492e24e87e6e4f225ef872e586444879a6b80ed44dd07fc63172992dee97263470df3b3bc1332d49ff20b4de
SSDEEP

3072:OOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:OIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000022e27-10.dat	acprotect
behavioral2/files/0x0008000000022e27-30.dat	acprotect
behavioral2/files/0x0008000000022e27-34.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1960	ctfmen.exe
2728	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
4568	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
2728	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\satornas.dll	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File created	C:\Windows\SysWOW64\shervans.dll	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File created	C:\Windows\SysWOW64\grcopy.dll	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File created	C:\Windows\SysWOW64\satornas.dll	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File created	C:\Windows\SysWOW64\smnss.exe	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	smnss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\FileSystemMetadata.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	smnss.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2728	WerFault.exe	96

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	NEAS.0fdf2c09bb6f7036de3a580502016510.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	NEAS.0fdf2c09bb6f7036de3a580502016510.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 1960	4568	NEAS.0fdf2c09bb6f7036de3a580502016510.exe	95
PID 4568 wrote to memory of 1960	4568	NEAS.0fdf2c09bb6f7036de3a580502016510.exe	95
PID 4568 wrote to memory of 1960	4568	NEAS.0fdf2c09bb6f7036de3a580502016510.exe	95
PID 1960 wrote to memory of 2728	1960	ctfmen.exe	96
PID 1960 wrote to memory of 2728	1960	ctfmen.exe	96
PID 1960 wrote to memory of 2728	1960	ctfmen.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.0fdf2c09bb6f7036de3a580502016510.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0fdf2c09bb6f7036de3a580502016510.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 1564
      4⤵
      Program crash
      PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2728 -ip 2728
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
ecb001934820903c8f33b12274771dfe

SHA1
c4d672696cfe688c9edb49bfd4724cfc2f6394f0

SHA256
72d86df103286415ac69fcd66bd7a450b629e205207908ee74bf83dcd7a52577

SHA512
e5dbf14833be83e13969cfdf1eee1595a7a57e3c0f5e59f15bca4f709b4e7b5cce7620417843c213af5c0e70cd217d78cc216f00ec64a91ad60616c34c1abf59

Download Submit
C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
ecb001934820903c8f33b12274771dfe

SHA1
c4d672696cfe688c9edb49bfd4724cfc2f6394f0

SHA256
72d86df103286415ac69fcd66bd7a450b629e205207908ee74bf83dcd7a52577

SHA512
e5dbf14833be83e13969cfdf1eee1595a7a57e3c0f5e59f15bca4f709b4e7b5cce7620417843c213af5c0e70cd217d78cc216f00ec64a91ad60616c34c1abf59

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
119KB

MD5
a1a96bc13c55c2a1eab8e69be01ffa78

SHA1
9c337e113b698e60fdac08ab6259638917b71907

SHA256
849cbf57effea0ca3b34276febd3195f362229620d5e371c1225b85f549efcdf

SHA512
f21be15958c8fec2c2cd4a1623cc309d6cf7d36209d37f4f7dbb09e15cee449b5c1a125ab2023b40b3bca2303131012da6af82897c0b522164ef420ba78b5043

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
119KB

MD5
a1a96bc13c55c2a1eab8e69be01ffa78

SHA1
9c337e113b698e60fdac08ab6259638917b71907

SHA256
849cbf57effea0ca3b34276febd3195f362229620d5e371c1225b85f549efcdf

SHA512
f21be15958c8fec2c2cd4a1623cc309d6cf7d36209d37f4f7dbb09e15cee449b5c1a125ab2023b40b3bca2303131012da6af82897c0b522164ef420ba78b5043

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
6761051c64d2af83d680030a74681b97

SHA1
e68b257bedec7fac682e161550b885e62916325f

SHA256
e03f3ad043410cad86b9a85eba3859a9e2334b4a6169457474178056897cc3d1

SHA512
18c088e6106ec79a3c7d93bc94aadf549d4f26b9a20d0bd591ad03de9a7b6779d1f15b15225738990eb0cd10cf58e73325ea3821bee2611b7af0503a044f769e

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
31a2784a683826aa3c2bc63019ae8853

SHA1
f2e1aca0d1e8cd3b66ec0a436435f9c46ae74c4d

SHA256
6093d57fc64c5617667bd129159ecae0514654e3bd048caad57a56d0b77434ac

SHA512
8b801328bf96553380018b8789e25e8d6a86479b4c8736c0498517a706b5c2b840ae6c12a0fd9dce7ba8773c0e74967a851cd36dbbedaad55926a5b3c864f390

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
31a2784a683826aa3c2bc63019ae8853

SHA1
f2e1aca0d1e8cd3b66ec0a436435f9c46ae74c4d

SHA256
6093d57fc64c5617667bd129159ecae0514654e3bd048caad57a56d0b77434ac

SHA512
8b801328bf96553380018b8789e25e8d6a86479b4c8736c0498517a706b5c2b840ae6c12a0fd9dce7ba8773c0e74967a851cd36dbbedaad55926a5b3c864f390

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
31a2784a683826aa3c2bc63019ae8853

SHA1
f2e1aca0d1e8cd3b66ec0a436435f9c46ae74c4d

SHA256
6093d57fc64c5617667bd129159ecae0514654e3bd048caad57a56d0b77434ac

SHA512
8b801328bf96553380018b8789e25e8d6a86479b4c8736c0498517a706b5c2b840ae6c12a0fd9dce7ba8773c0e74967a851cd36dbbedaad55926a5b3c864f390

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
119KB

MD5
a1a96bc13c55c2a1eab8e69be01ffa78

SHA1
9c337e113b698e60fdac08ab6259638917b71907

SHA256
849cbf57effea0ca3b34276febd3195f362229620d5e371c1225b85f549efcdf

SHA512
f21be15958c8fec2c2cd4a1623cc309d6cf7d36209d37f4f7dbb09e15cee449b5c1a125ab2023b40b3bca2303131012da6af82897c0b522164ef420ba78b5043

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
119KB

MD5
a1a96bc13c55c2a1eab8e69be01ffa78

SHA1
9c337e113b698e60fdac08ab6259638917b71907

SHA256
849cbf57effea0ca3b34276febd3195f362229620d5e371c1225b85f549efcdf

SHA512
f21be15958c8fec2c2cd4a1623cc309d6cf7d36209d37f4f7dbb09e15cee449b5c1a125ab2023b40b3bca2303131012da6af82897c0b522164ef420ba78b5043

Download Submit
memory/1960-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2728-29-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2728-36-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2728-37-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4568-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4568-26-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4568-21-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4568-13-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads