b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42

General

Target

b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Size

75KB
MD5

11916bfd75d500d92c5d70ba2caaa5c4
SHA1

42b2cfcefbd398e1b6287c2641f57646e3dc287a
SHA256

b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42
SHA512

0bd24b35845da8840675de3725863035979d439591b62f9bfd3b9d446251596954ddd7a1a3408465583e967ac7b87b1815a2acc6487b33e3f7f6d337a6671200
SSDEEP

1536:ex1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3s:eOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPE

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233e1-9.dat	UPX
behavioral2/memory/1256-17-0x0000000010000000-0x000000001000D000-memory.dmp	UPX
behavioral2/files/0x000300000001e9b1-19.dat	UPX
behavioral2/memory/4328-24-0x0000000000400000-0x0000000000409000-memory.dmp	UPX
behavioral2/memory/1256-23-0x0000000010000000-0x000000001000D000-memory.dmp	UPX
behavioral2/memory/2056-34-0x0000000010000000-0x000000001000D000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00080000000233e1-9.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4328	ctfmen.exe
2056	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
1256	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
2056	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
File created	C:\Windows\SysWOW64\satornas.dll	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
File created	C:\Windows\SysWOW64\shervans.dll	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
File created	C:\Windows\SysWOW64\grcopy.dll	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
File created	C:\Windows\SysWOW64\smnss.exe	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3768	2056	WerFault.exe	95

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 4328	1256	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe	94
PID 1256 wrote to memory of 4328	1256	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe	94
PID 1256 wrote to memory of 4328	1256	b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe	94
PID 4328 wrote to memory of 2056	4328	ctfmen.exe	95
PID 4328 wrote to memory of 2056	4328	ctfmen.exe	95
PID 4328 wrote to memory of 2056	4328	ctfmen.exe	95

C:\Users\Admin\AppData\Local\Temp\b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe
"C:\Users\Admin\AppData\Local\Temp\b9687b1090401d24b690502b9e1cbc6a0707643936f9b20b44781a09f8b9cb42.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1324
      4⤵
      Program crash
      PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2056 -ip 2056
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
cc0cf1088040cb9670c70c43a6c8e6e9

SHA1
a005c37585f4f056c9ccf95242f80395ae4ab058

SHA256
5e59f91796edc717c07d7c14caf8890c68d7d74af5bf13adfead0e7806320599

SHA512
f839b5cbc9eeebde52aab1f151027fc581c03b95dab61d71f739efe0a25dc9a67daa9f109c502e2d0b12e18ebe8612d2d9b22f8b8d1c75f0f522007d6cdbb709

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
75KB

MD5
61ffeb3becae1a8303a07b22d7de542b

SHA1
ae1f9772ddbc264c943ae5b9b0090632b7ab4da8

SHA256
58398c60027f09497b545cde4eb8367b7a8de2e372ac5e6fd0c0f24343391b37

SHA512
8c4526f0633d726919387c7e106528f3734a750e86d60cfdef7cd6fff3e84a0386fd3488fecbfde986d49c6423044bf439f44c22ce9cad1a3ac7db4217fad8ce

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
754e4c1b500c8db71782939a5be625ef

SHA1
251222bdb67bec8b6a3a7457dda0523d57d4efeb

SHA256
e5d543436db39b6c923f9e14ce85c727cf28874caee5a99f6076d413b35b412c

SHA512
acc00778465be31e53a0fdbf94a613336280fea99cb445af6bd76adb2629ec5506a5c4d581ee4841ebd4dbe517ec5a0a927153e14dff957405f69bb603ce914c

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
431992cc34afeafed59ac55f65e76b3c

SHA1
1429fbdac1c2263a3aa162021affe513e67048e7

SHA256
03ca1c8b8e834ae1cf02038a39e843d1e5b16acbe13e46aaf377c5dd06940a4d

SHA512
b5d2d73353f68504b05d107be989a9357593f9f5f13c2b4e70db655b448f16a4a6de6d812815ad5e55b08206dfb5c5b6cd8c0f6937b54fa6d2eb37beaffdd68f

Download Submit
memory/1256-17-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1256-20-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1256-23-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2056-34-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2056-35-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4328-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads