Overview
overview
10Static
static
1029d7ce5a27...53.exe
windows7-x64
729d7ce5a27...53.exe
windows10-1703-x64
729d7ce5a27...53.exe
windows10-2004-x64
729d7ce5a27...53.exe
windows11-21h2-x64
75826edef54...09.rar
windows7-x64
35826edef54...09.rar
windows10-1703-x64
35826edef54...09.rar
windows10-2004-x64
75826edef54...09.rar
windows11-21h2-x64
3AWB2024042...6A.vbs
windows7-x64
10AWB2024042...6A.vbs
windows10-1703-x64
8AWB2024042...6A.vbs
windows10-2004-x64
8AWB2024042...6A.vbs
windows11-21h2-x64
87cd4bfb3b0...0dc238
windows7-x64
17cd4bfb3b0...0dc238
windows10-1703-x64
17cd4bfb3b0...0dc238
windows10-2004-x64
17cd4bfb3b0...0dc238
windows11-21h2-x64
1bec046135e...be.exe
windows7-x64
7bec046135e...be.exe
windows10-1703-x64
7bec046135e...be.exe
windows10-2004-x64
7bec046135e...be.exe
windows11-21h2-x64
7bf71b1cf35...bc.exe
windows7-x64
10bf71b1cf35...bc.exe
windows10-1703-x64
10bf71b1cf35...bc.exe
windows10-2004-x64
10bf71b1cf35...bc.exe
windows11-21h2-x64
10e270915d93...fa.exe
windows7-x64
10e270915d93...fa.exe
windows10-1703-x64
10e270915d93...fa.exe
windows10-2004-x64
10e270915d93...fa.exe
windows11-21h2-x64
10Analysis
-
max time kernel
1501s -
max time network
1499s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-04-2024 14:40
Behavioral task
behavioral1
Sample
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
5826edef54998a8812124bbddc1942c9ff42992bdd1d5dd3395df71b7bb4c709.rar
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
5826edef54998a8812124bbddc1942c9ff42992bdd1d5dd3395df71b7bb4c709.rar
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
5826edef54998a8812124bbddc1942c9ff42992bdd1d5dd3395df71b7bb4c709.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
5826edef54998a8812124bbddc1942c9ff42992bdd1d5dd3395df71b7bb4c709.rar
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
AWB20240425-GW036A.vbs
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
AWB20240425-GW036A.vbs
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
AWB20240425-GW036A.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral12
Sample
AWB20240425-GW036A.vbs
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
7cd4bfb3b0e27989012024605cc453dbc8a226b413d84e2560ae4af70d0dc238
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
7cd4bfb3b0e27989012024605cc453dbc8a226b413d84e2560ae4af70d0dc238
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
7cd4bfb3b0e27989012024605cc453dbc8a226b413d84e2560ae4af70d0dc238
Resource
win10v2004-20240412-en
Behavioral task
behavioral16
Sample
7cd4bfb3b0e27989012024605cc453dbc8a226b413d84e2560ae4af70d0dc238
Resource
win11-20240412-en
Behavioral task
behavioral17
Sample
bec046135e9d128cf6021e387a8d8b7aab1f703b44564b53c54e422da2cf5bbe.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
bec046135e9d128cf6021e387a8d8b7aab1f703b44564b53c54e422da2cf5bbe.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
bec046135e9d128cf6021e387a8d8b7aab1f703b44564b53c54e422da2cf5bbe.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral20
Sample
bec046135e9d128cf6021e387a8d8b7aab1f703b44564b53c54e422da2cf5bbe.exe
Resource
win11-20240412-en
Behavioral task
behavioral21
Sample
bf71b1cf3516a2ad02efdda83c6f902e7139db69c1035a7e653ed09f5d27cbbc.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
bf71b1cf3516a2ad02efdda83c6f902e7139db69c1035a7e653ed09f5d27cbbc.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
bf71b1cf3516a2ad02efdda83c6f902e7139db69c1035a7e653ed09f5d27cbbc.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
bf71b1cf3516a2ad02efdda83c6f902e7139db69c1035a7e653ed09f5d27cbbc.exe
Resource
win11-20240412-en
Behavioral task
behavioral25
Sample
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral28
Sample
e270915d93536de8953dcf4001c4aa95e9b3c3ead079dbde425d65e1f7237efa.exe
Resource
win11-20240412-en
General
-
Target
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe
-
Size
595KB
-
MD5
f104e0cddd5679a3ffa2a3b5ee70eefe
-
SHA1
1a2e827e24bc502f2e041c23ddf64abc438b7e77
-
SHA256
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53
-
SHA512
74f9ff60c358653ccf1f97c2a82ee59ca43685c34a67d0d9936355ec45964556336a9a034276471d85b49c802a4af3becbf9e750094c9fa8abe50f0aff15eae5
-
SSDEEP
12288:hS0bPOw7r916Bd9nBedIoomaUu56GNIZTTN6VnRMfuQnjd6j:DZ516D9n/mar56G+T4Z6fuQnjEj
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
2mrfdQcyVLfQR2Z.exeCTS.exepid process 4408 2mrfdQcyVLfQR2Z.exe 3684 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
CTS.exe29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe -
Drops file in Windows directory 2 IoCs
Processes:
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exeCTS.exedescription pid process Token: SeDebugPrivilege 2552 29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe Token: SeDebugPrivilege 3684 CTS.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exedescription pid process target process PID 2552 wrote to memory of 4408 2552 29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe 2mrfdQcyVLfQR2Z.exe PID 2552 wrote to memory of 4408 2552 29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe 2mrfdQcyVLfQR2Z.exe PID 2552 wrote to memory of 3684 2552 29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe CTS.exe PID 2552 wrote to memory of 3684 2552 29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe CTS.exe PID 2552 wrote to memory of 3684 2552 29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe"C:\Users\Admin\AppData\Local\Temp\29d7ce5a27c3b1f26db84d5c6e0ae0899c3bf7bc1c345ac89cfb38c7e7baba53.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2mrfdQcyVLfQR2Z.exeC:\Users\Admin\AppData\Local\Temp\2mrfdQcyVLfQR2Z.exe2⤵
- Executes dropped EXE
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlFilesize
394KB
MD5d5f803cb4e579d06d5784c94ee59ab2f
SHA13edeff96889e1fcf7decc7679480e5e16ebba783
SHA256b1a1f05dd5a942e18cc3cae23cfa4eaeb7f9be20b1d2ab9aa15358ba00c73bee
SHA512ee406112cf12b2abe0929315be4f627b4edc396acbdffd22f9dcc474e4bf6cc7976aef2489bc59ae65ae81931d17b0587b31613f03ad12125b040b9db84ce311
-
C:\Users\Admin\AppData\Local\Temp\2mrfdQcyVLfQR2Z.exeFilesize
595KB
MD5f2ee0f110baa9b0da39231b26ad59ca5
SHA19b2987e5bedd969147864e7c9b5ee960ae48c3f1
SHA25621685e04291c0d2e4455d44a5340a15bd65ae86b6c4dc5c2e8ebc9ba56eee67d
SHA512e40ad1455c948af77718e3e2a3bab983ad37ff8151a1b3116464ab02252ae2cd34ceaed91adb5273873bdb76b68ba7e87c7857be90f39193777da0018dd9f90b
-
C:\Users\Admin\AppData\Local\Temp\2mrfdQcyVLfQR2Z.exeFilesize
524KB
MD5645d5875c0ce2052d93943c62238a06e
SHA138c00dfaa6e0192e1157212d5baf42a8db869776
SHA25666ef54018ef1207394bef76bcb0411f2fbbedd6230a812026bf8f1710218dbf9
SHA512eb9654b527ddc15fae042ef6fa6b8a25f76c2fc21314abd1d629bac5066cfa11d9f3c1191150dc7784b20e5e47c4855ab97d34fadf904989a7a43ccd626949fe
-
C:\Windows\CTS.exeFilesize
71KB
MD566df4ffab62e674af2e75b163563fc0b
SHA1dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA256075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
SHA5121588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25