Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 23:15

General

  • Target

    8dfb073895c4a3f81920a488dc23dc9124d5048907697048e07845303d4fbe56.exe

  • Size

    259KB

  • MD5

    344a42c7fa0f48108bbe1832d75b4296

  • SHA1

    a0b273d216487ea79096616a4225c157f522e967

  • SHA256

    8dfb073895c4a3f81920a488dc23dc9124d5048907697048e07845303d4fbe56

  • SHA512

    d97499d427815c6dd90a38ca117783f796c63afa3cbd54c6889b7d9c979894b850aee460df7c8fbaa93fc74dacda4a64d6e94d9d8b52104f5980917738d075c5

  • SSDEEP

    3072:kjr87SHQ/x7HmifDvzgN4G94Am5rpOqDr4f22ySnxucAVsQMos854h7Pegb/sH:5vAciOrVwpnxTKs5oZCU

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8dfb073895c4a3f81920a488dc23dc9124d5048907697048e07845303d4fbe56.exe
    "C:\Users\Admin\AppData\Local\Temp\8dfb073895c4a3f81920a488dc23dc9124d5048907697048e07845303d4fbe56.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\cYdKEDvYUvmEu1r.exe

    Filesize

    178KB

    MD5

    f4935e39cd1008b6677ecaff658b51d4

    SHA1

    c88f99bb82cbbf96992c36b61f6c614a15abc9d6

    SHA256

    ebc4c06b7d95e74e315419ee7e88e1d0f71e9e9477538c00a93a9ff8c66a6cfc

    SHA512

    b69050b1ee3a201d52a88742d7f441e5ea1cf5213729cccc634577807a1579c13f24d5ff28567d7dfa09633b21ffc51af7b44c0dbd82c0f5dd477aad72246906

  • C:\Windows\CTS.exe

    Filesize

    80KB

    MD5

    ec704028ad7125c2fa52e04dc68c0ca3

    SHA1

    2a63f27d0138696c9c27a9ea2534e8f2ca11ddc4

    SHA256

    5f77a5d7c9eac3b004820646dece450e315a6e3ed320dc183ae68d59cd2318bf

    SHA512

    a008a08c980583b8698431ca44fa45d5565fdc5316dc3e58c47ae523e7a7a776162979b0c79f9c64f0b71e0d98fb49102679378354f76c270d0c99207c15d160