Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 16:21
Behavioral task
behavioral1
Sample
df96ddf23b40e28b7ab0515b5c37e33a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
df96ddf23b40e28b7ab0515b5c37e33a.exe
Resource
win10v2004-20240319-en
General
-
Target
df96ddf23b40e28b7ab0515b5c37e33a.exe
-
Size
59KB
-
MD5
df96ddf23b40e28b7ab0515b5c37e33a
-
SHA1
92a37c0298d2ad7298900fabe947ce3481e47a8a
-
SHA256
a44a9dd0c436830579b5aa841d98b31d1794b06b542e2b54db280be18fd6ab33
-
SHA512
625d4f9184f43d985714061430a7b4d8c3cb252c7b9b39d5b26727a860eb7e9fa12cf90806f2fc010ce54ac560eb8845ee4c6759659883db4056e45978f5a794
-
SSDEEP
768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFGocAX3LKew369lp2z3+:SKcR4mjD9r823FHKcR4mjD9r823Fb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4148 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/880-0-0x0000000000B20000-0x0000000000B37000-memory.dmp upx behavioral2/files/0x0008000000023386-6.dat upx behavioral2/memory/880-7-0x0000000000B20000-0x0000000000B37000-memory.dmp upx behavioral2/memory/4148-9-0x0000000000B30000-0x0000000000B47000-memory.dmp upx behavioral2/files/0x00050000000226b7-12.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" df96ddf23b40e28b7ab0515b5c37e33a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe df96ddf23b40e28b7ab0515b5c37e33a.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 880 df96ddf23b40e28b7ab0515b5c37e33a.exe Token: SeDebugPrivilege 4148 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 880 wrote to memory of 4148 880 df96ddf23b40e28b7ab0515b5c37e33a.exe 92 PID 880 wrote to memory of 4148 880 df96ddf23b40e28b7ab0515b5c37e33a.exe 92 PID 880 wrote to memory of 4148 880 df96ddf23b40e28b7ab0515b5c37e33a.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\df96ddf23b40e28b7ab0515b5c37e33a.exe"C:\Users\Admin\AppData\Local\Temp\df96ddf23b40e28b7ab0515b5c37e33a.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2260,i,4762972005863767630,9297428255150568035,262144 --variations-seed-version /prefetch:81⤵PID:3896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5b9510c87a4aa78884fdb0e08d13c5368
SHA1fc6d1b7e2fbea9f9d322bda6f9a45e888e21a9d6
SHA256e93e2614f09b9994eb8322131650e90cadca356468b3bdf18a22eee061c9103a
SHA5129550d2c92b46c09cc895e57656295f7ef3ffbb91d1bc0917b653005b377f55210395edb58b8c637eadcd1de9c3e103415ab458d28fd99097337695533d57da64
-
Filesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d