Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 16:21

General

  • Target

    df96ddf23b40e28b7ab0515b5c37e33a.exe

  • Size

    59KB

  • MD5

    df96ddf23b40e28b7ab0515b5c37e33a

  • SHA1

    92a37c0298d2ad7298900fabe947ce3481e47a8a

  • SHA256

    a44a9dd0c436830579b5aa841d98b31d1794b06b542e2b54db280be18fd6ab33

  • SHA512

    625d4f9184f43d985714061430a7b4d8c3cb252c7b9b39d5b26727a860eb7e9fa12cf90806f2fc010ce54ac560eb8845ee4c6759659883db4056e45978f5a794

  • SSDEEP

    768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFGocAX3LKew369lp2z3+:SKcR4mjD9r823FHKcR4mjD9r823Fb

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df96ddf23b40e28b7ab0515b5c37e33a.exe
    "C:\Users\Admin\AppData\Local\Temp\df96ddf23b40e28b7ab0515b5c37e33a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4148
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2260,i,4762972005863767630,9297428255150568035,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3896

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

      Filesize

      380KB

      MD5

      b9510c87a4aa78884fdb0e08d13c5368

      SHA1

      fc6d1b7e2fbea9f9d322bda6f9a45e888e21a9d6

      SHA256

      e93e2614f09b9994eb8322131650e90cadca356468b3bdf18a22eee061c9103a

      SHA512

      9550d2c92b46c09cc895e57656295f7ef3ffbb91d1bc0917b653005b377f55210395edb58b8c637eadcd1de9c3e103415ab458d28fd99097337695533d57da64

    • C:\Windows\CTS.exe

      Filesize

      59KB

      MD5

      5efd390d5f95c8191f5ac33c4db4b143

      SHA1

      42d81b118815361daa3007f1a40f1576e9a9e0bc

      SHA256

      6028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74

      SHA512

      720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d

    • memory/880-0-0x0000000000B20000-0x0000000000B37000-memory.dmp

      Filesize

      92KB

    • memory/880-7-0x0000000000B20000-0x0000000000B37000-memory.dmp

      Filesize

      92KB

    • memory/4148-9-0x0000000000B30000-0x0000000000B47000-memory.dmp

      Filesize

      92KB