Overview

overview

8

Static

static

3

96a05ce865...24.exe

windows7-x64

8

96a05ce865...24.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 18:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe

  • Size

    118KB

  • MD5

    c6c66835d21c0def69d12bd90c649d91

  • SHA1

    68d5104e0290c8ca499f42e0c87e841da5585e40

  • SHA256

    96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224

  • SHA512

    f7a8c97c7f5249b6a4b0319ce3abbb8bb549f3834dc30bd8351d92749fffd3823e3ab9970657dbaba573bb53c1a6976f38316add53673812c46c724d2e9b0d1b

  • SSDEEP

    3072:8OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:8Is9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
    "C:\Users\Admin\AppData\Local\Temp\96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2324

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\grcopy.dll
          Filesize

          118KB

          MD5

          441d66a6b150b32fd1b8bc5fe61681b5

          SHA1

          5adbe13b596a6aa4fc31f3220a1479da8b013888

          SHA256

          778e08da15758b885947aa16a01e81a025951a75e466231969d1ba219165f0ac

          SHA512

          e892f86da52d3318990161c86456b4334d1e6af88eb7cd505b0728bb4d99913f14ded45d361aee43ef6076abdba2a3a2962b436e9511f898d39f1a99edc5aceb

          Download Submit

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          4e3543d92d240db829eacf8b021a05d6

          SHA1

          cd32d2e2e558244fe37b7908fc1ac982f9831780

          SHA256

          cbc0674320f32af2c2c1eafa049222bbe866ed54efe44f438c7b9e08428792da

          SHA512

          9a6bf0d6d8a6733df5811b35f09276cdcbafab03f047080833b49fce6dc695d5b009d0b7eba4329c7413c54a897d1457d0842cb3eeb966a5a07cb399d1005327

          Download Submit

        • \Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          73ed8988851ba6fecb4fca45f2ca01d9

          SHA1

          4e726d772644042d4b2ad0ef2acba46a21dd4263

          SHA256

          5f3cc880427c7b4197f2700776c45a55586d33ba73de7b20fe980663ef73395c

          SHA512

          735e976ad9f955a54eeb2c0c55c2487f058448d1b59ad5d02f72d4b8e6f495dd01b3a872d05cdfc64dd983aececce251dcbf3d6d51208b5a06c2629c55b48b45

          Download Submit

        • \Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          6da5feae3edb2886661092307aa83248

          SHA1

          db20af45ade17b224e7a90cfc43af5128bb5652a

          SHA256

          5d348995b619d692d7992028685c0fefd125466494f22ac7d1a6f575f0238c55

          SHA512

          bbf2c3e87d4f07d4ab36f6b66a7ea9934a9024651d978306a87473f05521948dec9e934f2d07dd0614a1baf41900182292f0a5a17576a821e7c0a27ce2dc7984

          Download Submit

        • memory/2324-41-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2324-35-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2324-44-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2392-16-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2392-18-0x00000000003C0000-0x00000000003C9000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2392-25-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2392-0-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2392-26-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2668-34-0x0000000000320000-0x000000000033F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2668-32-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download