Overview

overview

10

Static

static

10

694f46b7d7...ba.exe

windows7-x64

9

694f46b7d7...ba.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 22:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    694f46b7d707925e0644b8c980f9e6b3f25aeffec4dbe7f6f71e831f877e34ba.exe

  • Size

    119KB

  • MD5

    0cb976bfe4484969e29a2633db49f8cb

  • SHA1

    4b5ff6f9420de0387a0df421c411b74658e1e6c0

  • SHA256

    694f46b7d707925e0644b8c980f9e6b3f25aeffec4dbe7f6f71e831f877e34ba

  • SHA512

    3192cef40d5065a1f549f1aed76a7fe59f3e06989bea79bc062fe29375e647356110262c1fe9461933c38fd41505171e87c3c06233dbb5e60dc46af39ba8cb59

  • SSDEEP

    3072:oOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:oIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 12 IoCs
  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\694f46b7d707925e0644b8c980f9e6b3f25aeffec4dbe7f6f71e831f877e34ba.exe
    "C:\Users\Admin\AppData\Local\Temp\694f46b7d707925e0644b8c980f9e6b3f25aeffec4dbe7f6f71e831f877e34ba.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2576

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\grcopy.dll
          Filesize

          119KB

          MD5

          c06bc8e58f1f693c5279c6f04d869991

          SHA1

          43d42f99680c11658579a068818916ff782a6484

          SHA256

          6620df20ca402a9472ad533b5265627c550f5c5e9e804cea9474768fbb91131f

          SHA512

          38bcdce2fff661998a88561e3e05b5e6409ee25a86407a5e3f3bd3ca4ff77e8a438f1e7cc3ba9c6ff04ad0f556d0c7ce3aabc2ed6b4065e95d2171699b2fc8c6

          Download Submit

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          012c5e96f6d1c41411b89823d3a094f9

          SHA1

          7c09f3f081615bb886b049a159d3e1e118cf88e8

          SHA256

          bdfb869d5ed496c8aec86dee6ad07df5dc3c25c5dfc944164a2725d003999bf8

          SHA512

          b14d18c4d8cd6fbd53e75816863139e57f5a742c842d4d31eab727a128e56aea0a7084cfb4e87d9b78127e9879ed8c82c066323013f72937ba2d69477398865a

          Download Submit

        • \Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          1c0020281107354bf6cecd1ca8dfde87

          SHA1

          1d41b52e2796686eac646e4e0cde0b27fcb70584

          SHA256

          6ec2700b259c38b3e0aefb38e11c5906f482c2a29bc8572d443fc67001f15310

          SHA512

          bb58daea4c55061821f2b78051ffa42321ac93386b2dde604b32cfdd08cf4e73d2e49c3c8c56a1be52e79d222c35a0504329a4621d3b849363cc944aa26815f7

          Download Submit

        • \Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          12d6813490517872fe8d947637176fba

          SHA1

          49e4e5efc79d6850b4243d21d6f84c39b3b0dc9c

          SHA256

          f201ce4850b4d7c34681b2e867245397f4f159e4dff6403efcb016679253dd22

          SHA512

          84a2253993020b657a5e388f07268481e95a4243c6c93ba7b845f13e071463e826a82163761c11a4fbf3fca55fd843b60e0e2eef95b34892a3434147620d1b71

          Download Submit

        • memory/2568-26-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2576-43-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2576-40-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2576-37-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3068-27-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3068-24-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/3068-0-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3068-19-0x0000000000350000-0x0000000000359000-memory.dmp

          Filesize

          36KB

          Download

        • memory/3068-16-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download