Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 05:41
Behavioral task
behavioral1
Sample
baa768926b004c4c808054834ce66f15.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
baa768926b004c4c808054834ce66f15.exe
Resource
win10v2004-20240226-en
General
-
Target
baa768926b004c4c808054834ce66f15.exe
-
Size
116KB
-
MD5
baa768926b004c4c808054834ce66f15
-
SHA1
d5218d83ce8ec63076a352cc18732b7ce1fd3a26
-
SHA256
d9a53ddd01fe8ec217586f578e8b383b7408880815fc8ebf8989d796187e3eaa
-
SHA512
ec386ceb33907f9c756e04c71427e2c0ab6c435ec58b068e8a52aa814f49a1a343b44a0cf9c8a5862e1125264aa137a28b4a1fde4a629218de9506f638261ee3
-
SSDEEP
3072:SKcWmjRrz34Z3Jn4iR6bbpQZKHCCDV59V1/iEiG+pU:hG4MiRf6BVZ87a
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1680 aT3OLdkEHJVYunZ.exe 3436 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2432-0-0x00000000006B0000-0x00000000006C7000-memory.dmp upx behavioral2/memory/3436-8-0x00000000004E0000-0x00000000004F7000-memory.dmp upx behavioral2/memory/2432-9-0x00000000006B0000-0x00000000006C7000-memory.dmp upx behavioral2/files/0x0009000000023215-7.dat upx behavioral2/files/0x000600000002275d-12.dat upx behavioral2/memory/3436-31-0x00000000004E0000-0x00000000004F7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" baa768926b004c4c808054834ce66f15.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe baa768926b004c4c808054834ce66f15.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2432 baa768926b004c4c808054834ce66f15.exe Token: SeDebugPrivilege 3436 CTS.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2432 wrote to memory of 1680 2432 baa768926b004c4c808054834ce66f15.exe 88 PID 2432 wrote to memory of 1680 2432 baa768926b004c4c808054834ce66f15.exe 88 PID 2432 wrote to memory of 1680 2432 baa768926b004c4c808054834ce66f15.exe 88 PID 2432 wrote to memory of 3436 2432 baa768926b004c4c808054834ce66f15.exe 89 PID 2432 wrote to memory of 3436 2432 baa768926b004c4c808054834ce66f15.exe 89 PID 2432 wrote to memory of 3436 2432 baa768926b004c4c808054834ce66f15.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\baa768926b004c4c808054834ce66f15.exe"C:\Users\Admin\AppData\Local\Temp\baa768926b004c4c808054834ce66f15.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\aT3OLdkEHJVYunZ.exeC:\Users\Admin\AppData\Local\Temp\aT3OLdkEHJVYunZ.exe2⤵
- Executes dropped EXE
PID:1680
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
351KB
MD551daf7b003cb3b54d9752fee98c35c58
SHA1a2680e6dcb9aa4a7c65c7feb1490f1c3a5276093
SHA256b0e101835d33460cff6fef4c82c9a3d1ac607d2a86ea619e126c5e8320fd52de
SHA512c432da82e23084aea96ec89b756f25022875c3b769fbdcfaef8cb0447110a9764e88964937a855b278b511029a190f87c7898f9ac9a90639b391c9537ecd4468
-
Filesize
87KB
MD5015207664f86b0d334146d7bc7551a0f
SHA1b466beca074c3c4a500bfa00fd691cf0fe300d8c
SHA2563212cacc4d669f381ad1048e43726ec2841de32135438992c55f792bf03beafc
SHA5126ced0d294fd9c330cab20739336c6cd4c1e202d521fd41c6fd6bdfe7e720247c84ac10a7e25855d3cc9b08f2d9251798eb52383527a9363c5126a6b205ff0657
-
Filesize
29KB
MD570aa23c9229741a9b52e5ce388a883ac
SHA1b42683e21e13de3f71db26635954d992ebe7119e
SHA2569d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2
SHA512be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5