Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:45
Behavioral task
behavioral1
Sample
7500dde5fbb1ddbc517b9c47cb365eb0.exe
Resource
win7-20231215-en
General
-
Target
7500dde5fbb1ddbc517b9c47cb365eb0.exe
-
Size
130KB
-
MD5
7500dde5fbb1ddbc517b9c47cb365eb0
-
SHA1
62b739c8424df63e41f28a80666a1c2dde4e0511
-
SHA256
e7d6dcd26da0b0d7995cf046a83d42c6c54a0d446d1ec62eb387e73573fca209
-
SHA512
0f1b91eb4271653151261512f562c57e612ef16638e1156ea099b99c0b452a0a93e69b0f2f739ba60104e3e059ee4f1ab4bd975bd0afddb0a2d8e38013d9b585
-
SSDEEP
3072:SKcWmjRrz3ZKcWmjRrz3OtjuPOkI3tu1p9Yqv4vH:hGyGOcWp3tuFvo
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
v1jhhdzc6oFarV5.exeCTS.exepid process 2072 v1jhhdzc6oFarV5.exe 2292 CTS.exe -
Loads dropped DLL 1 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exepid process 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2264-1-0x00000000000D0000-0x00000000000E7000-memory.dmp upx behavioral1/memory/2264-11-0x00000000000D0000-0x00000000000E7000-memory.dmp upx behavioral1/memory/2292-14-0x00000000009F0000-0x0000000000A07000-memory.dmp upx C:\Windows\CTS.exe upx C:\Users\Admin\AppData\Local\Temp\v1jhhdzc6oFarV5.exe upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exeCTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 7500dde5fbb1ddbc517b9c47cb365eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 7500dde5fbb1ddbc517b9c47cb365eb0.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exeCTS.exedescription pid process Token: SeDebugPrivilege 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe Token: SeDebugPrivilege 2292 CTS.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exedescription pid process target process PID 2264 wrote to memory of 2072 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe v1jhhdzc6oFarV5.exe PID 2264 wrote to memory of 2072 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe v1jhhdzc6oFarV5.exe PID 2264 wrote to memory of 2072 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe v1jhhdzc6oFarV5.exe PID 2264 wrote to memory of 2072 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe v1jhhdzc6oFarV5.exe PID 2264 wrote to memory of 2072 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe v1jhhdzc6oFarV5.exe PID 2264 wrote to memory of 2072 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe v1jhhdzc6oFarV5.exe PID 2264 wrote to memory of 2072 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe v1jhhdzc6oFarV5.exe PID 2264 wrote to memory of 2292 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe CTS.exe PID 2264 wrote to memory of 2292 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe CTS.exe PID 2264 wrote to memory of 2292 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe CTS.exe PID 2264 wrote to memory of 2292 2264 7500dde5fbb1ddbc517b9c47cb365eb0.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7500dde5fbb1ddbc517b9c47cb365eb0.exe"C:\Users\Admin\AppData\Local\Temp\7500dde5fbb1ddbc517b9c47cb365eb0.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\v1jhhdzc6oFarV5.exeC:\Users\Admin\AppData\Local\Temp\v1jhhdzc6oFarV5.exe2⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\v1jhhdzc6oFarV5.exeFilesize
130KB
MD5fdeb4dfaaf4babab987ff918b2020510
SHA125ebb96de9d371affc6df79eb941250b2a4c5a59
SHA256245b5735155914ff1e08549f68d993a796d85d0d5f5f775f54f361e5276bd6da
SHA51245b31a9d1b17abdae52ed6f5ef4fb7cfdecb998472beee3bc5ae84506bc0b0e32f2b7a9151ab1651844cdb89ba063ac282c3459e83551b15859e9e38945fe402
-
C:\Windows\CTS.exeFilesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d
-
\Users\Admin\AppData\Local\Temp\v1jhhdzc6oFarV5.exeFilesize
71KB
MD53f1a1f5fbc852fabe1daec89efc19b15
SHA1cd6e4c2efbe22e5712de745f7d9cdebd29ac117c
SHA2560d3a83a6df2c5e94267e3129bf874dc32c354e04f4f8a2fc98f6314e7c58f576
SHA51277377378b0ed20f605f8dc65b149402eebf8ca612f58ba6aa894a12341d3dc59a15890419932e696f544c764f4a5eabed59eb0531c6449fb1d119a540dd88262
-
memory/2264-1-0x00000000000D0000-0x00000000000E7000-memory.dmpFilesize
92KB
-
memory/2264-11-0x00000000000D0000-0x00000000000E7000-memory.dmpFilesize
92KB
-
memory/2292-14-0x00000000009F0000-0x0000000000A07000-memory.dmpFilesize
92KB