Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 05:41

General

  • Target

    2a6a35dd6204faf86248fa5f671dc04d.exe

  • Size

    115KB

  • MD5

    2a6a35dd6204faf86248fa5f671dc04d

  • SHA1

    0b867d6f62ccc5d6e72cf0274299fec4856ad686

  • SHA256

    9425ccfb3911b1af58bf9aea6e9d7e0aa3e9bf95de26dbb8f70c4f0316e572e3

  • SHA512

    c73a4a8e15d491973f78aca42055982f61f44f8eee6762b71ef822acd479f5c91d0706ab2d67e1c7ab8aa765111b87a9a2b30962531deae8ee64945f47277fa3

  • SSDEEP

    3072:SKcWmjRrz3ZKcWmjRrz30272yx/Jqr8Je2dd4f5+X1:hGyGfFi8s2du+X1

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a6a35dd6204faf86248fa5f671dc04d.exe
    "C:\Users\Admin\AppData\Local\Temp\2a6a35dd6204faf86248fa5f671dc04d.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4412
    • C:\Users\Admin\AppData\Local\Temp\waPtvvx2KWuOesU.exe
      C:\Users\Admin\AppData\Local\Temp\waPtvvx2KWuOesU.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4392
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 812
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\waPtvvx2KWuOesU.exe

    Filesize

    56KB

    MD5

    e115521ba14b75f53dcdff087ec6898f

    SHA1

    87103a892bb514a93d485fba221bacb9da3aae25

    SHA256

    59b284d0ad4c2634938e70fae67d9048bd98422d052fbd745a9b80b5fae7ae29

    SHA512

    ab3d097bcf11bf7327a28124052b210f5fb13b9bfb9b7376cae1ba5c30182a330506935288a7fe06b7e3fdd82b57f5c31638f1c301738342819c772b346fa35a

  • C:\Windows\CTS.exe

    Filesize

    59KB

    MD5

    5efd390d5f95c8191f5ac33c4db4b143

    SHA1

    42d81b118815361daa3007f1a40f1576e9a9e0bc

    SHA256

    6028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74

    SHA512

    720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d

  • memory/4392-27-0x00007FFF5A780000-0x00007FFF5B121000-memory.dmp

    Filesize

    9.6MB

  • memory/4392-33-0x0000000001470000-0x0000000001480000-memory.dmp

    Filesize

    64KB

  • memory/4392-30-0x00007FFF5A780000-0x00007FFF5B121000-memory.dmp

    Filesize

    9.6MB

  • memory/4392-39-0x00007FFF5A780000-0x00007FFF5B121000-memory.dmp

    Filesize

    9.6MB

  • memory/4412-9-0x0000000000610000-0x0000000000627000-memory.dmp

    Filesize

    92KB

  • memory/4752-0-0x0000000000890000-0x00000000008A7000-memory.dmp

    Filesize

    92KB

  • memory/4752-6-0x0000000000890000-0x00000000008A7000-memory.dmp

    Filesize

    92KB