Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 22:57

General

  • Target

    855f362a587183016e67bbc04e9994ed3fd1ce2221b409a3bd4c4e8ec2e3debb.exe

  • Size

    75KB

  • MD5

    82384dba305026b64af4209ef1bd439d

  • SHA1

    81ff94b87a3a45788b89d41cd031867599606fd4

  • SHA256

    855f362a587183016e67bbc04e9994ed3fd1ce2221b409a3bd4c4e8ec2e3debb

  • SHA512

    157a94699dcbf1644cd0dee7c64e6502c22660282d4f49c417157b0ed655c1df91206d9c513ff84aa4f7cae98d0a61ad930cd02a8b6503a80f4deafed8674659

  • SSDEEP

    1536:lx1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3s:vOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPE

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 7 IoCs
  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\855f362a587183016e67bbc04e9994ed3fd1ce2221b409a3bd4c4e8ec2e3debb.exe
    "C:\Users\Admin\AppData\Local\Temp\855f362a587183016e67bbc04e9994ed3fd1ce2221b409a3bd4c4e8ec2e3debb.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll

    Filesize

    183B

    MD5

    e3dcb2e041e74be3ac4c4dc5923defd1

    SHA1

    b123e230ac7f11a16080781fd3fd02bb446c3e1c

    SHA256

    1d1b8a4342015889b65cdaa69d2bbc3a8b851cd143a9ca209742bd01c3973f30

    SHA512

    6e67d91ea907fe8cad8ce79dd9decbf16a958cb3cb8a3771655a9d7d4091774724215ee2e48894fedf695499dd2c2fb9642e661c1c4f589301a9f21c18648b5a

  • C:\Windows\SysWOW64\smnss.exe

    Filesize

    75KB

    MD5

    998374cad53940782a9e0e67ca9bc3fb

    SHA1

    602745e5dd9c35bb777c4a5a42d908dd5c3178bb

    SHA256

    b619cbde65549dd6d072b1013d8528704d2e11db5f936ba480866283d850b27c

    SHA512

    4fccce36449f0e55d87eb32abf43e5d17944e238f702f21bf9c90d4ac4b6615eca156953e34c6bad8b8f14edb489c9fbe908eb907770e0ffb5664cc26a763688

  • \Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    49599eaa984194e855e4841aba9bfc7a

    SHA1

    be031bbdbe1cf76d1b3e97b84aaf5fbe0d942e3d

    SHA256

    d7adcde7f7b46e1a531122f22383f041fb474f3b61f5ed064a558836dd3549dd

    SHA512

    c516a9acc812dfb6140ed083a42cceb8518e96eda5f311cbe6c74473f919d4427dc1d2b6d6665578f8e6569f96943f757c782d0db284d5b77fc7c72d238d2675

  • \Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    0f97578cef9a8f33c9b09a24f6f38caf

    SHA1

    bb1914dfec6db479f7ae1d63f3748e9beab70831

    SHA256

    e30ff50d468e10046049b555703a4aa20af81072636ba0c32d53eb47b4d8cd5d

    SHA512

    241711453bb996aa6f3a01427046d384c8ea129ce787a36e088097a92c6f0d6f2c1c44cdb8a865f94daad8dc2559ecd3263c66da940b50deebd6f35e78e9843a

  • memory/2328-11-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2328-17-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

  • memory/2328-23-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2328-29-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2684-30-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2700-43-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-51-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-41-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-38-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2700-45-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-47-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-49-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-39-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-53-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-55-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-57-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-59-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-61-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-63-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2700-65-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB