Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:45
Behavioral task
behavioral1
Sample
7500dde5fbb1ddbc517b9c47cb365eb0.exe
Resource
win7-20231215-en
General
-
Target
7500dde5fbb1ddbc517b9c47cb365eb0.exe
-
Size
130KB
-
MD5
7500dde5fbb1ddbc517b9c47cb365eb0
-
SHA1
62b739c8424df63e41f28a80666a1c2dde4e0511
-
SHA256
e7d6dcd26da0b0d7995cf046a83d42c6c54a0d446d1ec62eb387e73573fca209
-
SHA512
0f1b91eb4271653151261512f562c57e612ef16638e1156ea099b99c0b452a0a93e69b0f2f739ba60104e3e059ee4f1ab4bd975bd0afddb0a2d8e38013d9b585
-
SSDEEP
3072:SKcWmjRrz3ZKcWmjRrz3OtjuPOkI3tu1p9Yqv4vH:hGyGOcWp3tuFvo
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
lwFnJHyK5Wbi7f2.exeCTS.exepid process 4076 lwFnJHyK5Wbi7f2.exe 4184 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4396-0-0x00000000002D0000-0x00000000002E7000-memory.dmp upx behavioral2/memory/4184-9-0x0000000000BD0000-0x0000000000BE7000-memory.dmp upx behavioral2/memory/4396-8-0x00000000002D0000-0x00000000002E7000-memory.dmp upx C:\Windows\CTS.exe upx C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exeCTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 7500dde5fbb1ddbc517b9c47cb365eb0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 7500dde5fbb1ddbc517b9c47cb365eb0.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exeCTS.exedescription pid process Token: SeDebugPrivilege 4396 7500dde5fbb1ddbc517b9c47cb365eb0.exe Token: SeDebugPrivilege 4184 CTS.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7500dde5fbb1ddbc517b9c47cb365eb0.exedescription pid process target process PID 4396 wrote to memory of 4076 4396 7500dde5fbb1ddbc517b9c47cb365eb0.exe lwFnJHyK5Wbi7f2.exe PID 4396 wrote to memory of 4076 4396 7500dde5fbb1ddbc517b9c47cb365eb0.exe lwFnJHyK5Wbi7f2.exe PID 4396 wrote to memory of 4076 4396 7500dde5fbb1ddbc517b9c47cb365eb0.exe lwFnJHyK5Wbi7f2.exe PID 4396 wrote to memory of 4184 4396 7500dde5fbb1ddbc517b9c47cb365eb0.exe CTS.exe PID 4396 wrote to memory of 4184 4396 7500dde5fbb1ddbc517b9c47cb365eb0.exe CTS.exe PID 4396 wrote to memory of 4184 4396 7500dde5fbb1ddbc517b9c47cb365eb0.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7500dde5fbb1ddbc517b9c47cb365eb0.exe"C:\Users\Admin\AppData\Local\Temp\7500dde5fbb1ddbc517b9c47cb365eb0.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\lwFnJHyK5Wbi7f2.exeC:\Users\Admin\AppData\Local\Temp\lwFnJHyK5Wbi7f2.exe2⤵
- Executes dropped EXE
PID:4076 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlFilesize
382KB
MD519ec444f439d4e50b77ba1229722c2dd
SHA1e5059c196bb64230c46789426a3d5fa662df80dc
SHA2568fb35438898dcc782998b1073f93a05cea2e0c21310292b015e5afebd0367799
SHA51215a309c968a3ff18a532d0c7c9835c929e9e8467c5e858d5e9cb925c707bc06f9ca39c866f753adfef5f4a7b0d48186c09e13ecc4d7581e64fb2c9317200a8ad
-
C:\Users\Admin\AppData\Local\Temp\lwFnJHyK5Wbi7f2.exeFilesize
71KB
MD53f1a1f5fbc852fabe1daec89efc19b15
SHA1cd6e4c2efbe22e5712de745f7d9cdebd29ac117c
SHA2560d3a83a6df2c5e94267e3129bf874dc32c354e04f4f8a2fc98f6314e7c58f576
SHA51277377378b0ed20f605f8dc65b149402eebf8ca612f58ba6aa894a12341d3dc59a15890419932e696f544c764f4a5eabed59eb0531c6449fb1d119a540dd88262
-
C:\Windows\CTS.exeFilesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d
-
memory/4184-9-0x0000000000BD0000-0x0000000000BE7000-memory.dmpFilesize
92KB
-
memory/4396-0-0x00000000002D0000-0x00000000002E7000-memory.dmpFilesize
92KB
-
memory/4396-8-0x00000000002D0000-0x00000000002E7000-memory.dmpFilesize
92KB