2935b0f9ce63f177e615ef90ef6063c5e8e0ff85230acc0ea36ffcf8b58ba558

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12e568b41ff12216035f1c107ffb23d3.exe
Size

46KB
MD5

12e568b41ff12216035f1c107ffb23d3
SHA1

f2134e852ddf645aede1e900273b8eb2d36895ea
SHA256

2935b0f9ce63f177e615ef90ef6063c5e8e0ff85230acc0ea36ffcf8b58ba558
SHA512

d18c0c81c425420a0557240f063a9124b189811706149d130acc510f6026bdc320ff84f7683abd0fd5160850922a4dc9d8e564c1d0286b0647e637be30e60285
SSDEEP

768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFzvNASUGA8S7snuK7qer:SKcR4mjD9r823FzvNA4F00uK7qe6bpm

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1616	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2824-0-0x00000000001F0000-0x0000000000207000-memory.dmp	upx
behavioral2/files/0x000700000002322c-6.dat	upx
behavioral2/memory/2824-7-0x00000000001F0000-0x0000000000207000-memory.dmp	upx
behavioral2/memory/1616-9-0x0000000000810000-0x0000000000827000-memory.dmp	upx
behavioral2/files/0x0005000000022705-12.dat	upx
behavioral2/files/0x000400000001e716-29.dat	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	12e568b41ff12216035f1c107ffb23d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	12e568b41ff12216035f1c107ffb23d3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	12e568b41ff12216035f1c107ffb23d3.exe
Token: SeDebugPrivilege	1616	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1616	2824	12e568b41ff12216035f1c107ffb23d3.exe	90
PID 2824 wrote to memory of 1616	2824	12e568b41ff12216035f1c107ffb23d3.exe	90
PID 2824 wrote to memory of 1616	2824	12e568b41ff12216035f1c107ffb23d3.exe	90

C:\Users\Admin\AppData\Local\Temp\12e568b41ff12216035f1c107ffb23d3.exe
"C:\Users\Admin\AppData\Local\Temp\12e568b41ff12216035f1c107ffb23d3.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
352KB

MD5
0685d8f84678bc25e7285115d2d6caed

SHA1
8198d13e00182e87f7592efef00de3b1d4e371a3

SHA256
f76d0b8eb3b0dab4e73da97c8a426d5b2e59cdd4b33c98d760cba71b48cfe92c

SHA512
9c93d7c9b9286fb12791f6c77bca33faf05ebceb5813e910ed51ca9f84fe24f3316afef5ed98fe8dec092255bd1c7f5b8a6b32e5263ab8410fc83c4427e11f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\egvCvBoys57Z0so.exe

Filesize
46KB

MD5
5f5b4f4682289fa4ed9abe2c72da5804

SHA1
c0463e7b80a35be7ce2ed738f883e174287eac57

SHA256
0773c74f002df4af7b3f69735978a25fd0bc5f66872a9d6350ce3978be4b6446

SHA512
88291da259b5ebe69f664332c175dd6f7b442b4cfdf659602863ab5e1e05212225d5fef7e4f08fb0aa40cda1da7e3c57f4677e078dc944dd7849e4b9d473f9ca

Download Submit
C:\Windows\CTS.exe

Filesize
29KB

MD5
70aa23c9229741a9b52e5ce388a883ac

SHA1
b42683e21e13de3f71db26635954d992ebe7119e

SHA256
9d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2

SHA512
be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5

Download Submit
memory/1616-9-0x0000000000810000-0x0000000000827000-memory.dmp

Filesize
92KB

Download
memory/2824-0-0x00000000001F0000-0x0000000000207000-memory.dmp

Filesize
92KB

Download
memory/2824-7-0x00000000001F0000-0x0000000000207000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads