Overview

overview

8

Static

static

3

d9fb02c488...9a.exe

windows7-x64

8

d9fb02c488...9a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-03-2024 15:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d9fb02c488cc8b45df9bfcb17fe722b23fd5a0b6b63ffe810a2749fde1ccf69a.exe

  • Size

    127KB

  • MD5

    86215c256ec57cc76e6fec0cdc5a12ca

  • SHA1

    c4f8732bfb38fae87814efc232eb988bb0b1f801

  • SHA256

    d9fb02c488cc8b45df9bfcb17fe722b23fd5a0b6b63ffe810a2749fde1ccf69a

  • SHA512

    127cfeb33ca0ac86bbd08966f3820524d7bb1af9440bb71d1a48e3070ecafcab5df9fc921b1a369bbacd6c40a6012a56ffa4bfcedb51eb08276f9ee461292b4b

  • SSDEEP

    3072:vOjWuyt0RsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPB:vI89OKofHfHTXQLzgvnzHPowYbvrjD/g

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9fb02c488cc8b45df9bfcb17fe722b23fd5a0b6b63ffe810a2749fde1ccf69a.exe
    "C:\Users\Admin\AppData\Local\Temp\d9fb02c488cc8b45df9bfcb17fe722b23fd5a0b6b63ffe810a2749fde1ccf69a.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:896
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    127KB

    MD5

    99aead4b3680fbd3a3f1dd739f9a4cfa

    SHA1

    d166048b0b1602047c6a89f7c330c946de4371c3

    SHA256

    ee82c6aa664ceec89bb91eb9fd01f3e2bb4542c7d7e59567f7028e00215c8b85

    SHA512

    86bd62e91263f6a378448eebe914b9f03528cbd3685e5e9df21b2671ac460a90ff922c8554cbe01cba07968e8afb2e87690d6c860b652270247846826d7139fd

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    2c7f17aafa94580fb8a301e8f92e3c42

    SHA1

    76aed721090f3095cd650131dc74c717d5136175

    SHA256

    cb6a37c3d6ce927cd894fac97894a820527a8ee562a0a3461c0eaef30856bf44

    SHA512

    8d5fbf54d78d0dc19d832c01d8301923b9f8019e9cfb95275ab5c7c31f087f64d40f576fd0e758dd207e9e96a14b3b0f3f6436bef72a7e95f4b4f0c69d63db89

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    7b219723dac937fbdfd6d997bd6c25a8

    SHA1

    92e65dec589de9d99af27a1ef30dd7bb57158a10

    SHA256

    4c0e96896a6acee176306a2b9299d30c751d533d6d15ee82f73cdfdcff1b7791

    SHA512

    a7e67a3b0db8c1355939d7106ffc92038e5f120e0affeb784025ae2744a6d60318eb9f6c3123e7e3a6bcb75f40723d3d421b1d59ab46260531158f5c5508e596

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    a57740a1945b61d94cc2700fdcb00be8

    SHA1

    cf8b538eaffcfa6e4ebab9d9febf7aa78cbb1d05

    SHA256

    427c978a182efff1762c2690ac94a0fb948d834057ed30e4e6bcc4682e960e69

    SHA512

    98253e82d520ae671e2011af0ad75496671386d30d9809e962a66d089c5ce8d8f1333c606f7753fe5669d25c735a333a71621fdbb98cd722f102d87a5431a083

    Download Submit

  • memory/896-26-0x00000000002B0000-0x00000000002B9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/896-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/896-0-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/896-27-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/896-18-0x00000000002B0000-0x00000000002B9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/896-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2516-34-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/2516-39-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2516-41-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2516-43-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/2540-31-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download