Overview

overview

10

Static

static

10

d612dec7da...56.exe

windows7-x64

9

d612dec7da...56.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 03:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d612dec7da448b16b1c8b70aefcef06ed4cbeddfbdddb7cbe2c1f0afdf714056.exe

  • Size

    118KB

  • MD5

    50e7fbe000ff3fc25eac772e6cdc33ed

  • SHA1

    eea72c5aaffcaa4e69dfa7fda8dc7a4ec71f4650

  • SHA256

    d612dec7da448b16b1c8b70aefcef06ed4cbeddfbdddb7cbe2c1f0afdf714056

  • SHA512

    9fcefdeeceb5c5def966deb19df388553cfe200ddd163efba3c939639b5571380fe32e45731e92dfdd01d9a5ac9499e09f2318755fb9129109563228d8f25af7

  • SSDEEP

    3072:OOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:OIs9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 11 IoCs
  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d612dec7da448b16b1c8b70aefcef06ed4cbeddfbdddb7cbe2c1f0afdf714056.exe
    "C:\Users\Admin\AppData\Local\Temp\d612dec7da448b16b1c8b70aefcef06ed4cbeddfbdddb7cbe2c1f0afdf714056.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3448
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    7ee985a3b43ac4cd085d72bd08a51a28

    SHA1

    d9007912d7a92139eeff010dfbf8b5e6cf4d4a5f

    SHA256

    3a550d73f8aa946f1d4ad25d99bc3ae68da658d6bd5ae20b76e248f477baaf5d

    SHA512

    a89932485efefe20ecf91213956795df9165aa4ccd1a3e3a99de28c959c9c34f5a06c6c8ec9f7f80b89810ccb4cc46831f26f98103ff72fb85b280f601aa8087

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    118KB

    MD5

    69bebc05e53b1dc9e9be57c9c0a98229

    SHA1

    d3a8ccbeb2f3d5c5d30fc82dc4a1cb4380372652

    SHA256

    2ff00a3bccb4fac79c92e46f8a445a6ea59ff0c54f3e465fcab02a208fa20c5a

    SHA512

    c6b3344181c5d0f997358b0675bd35f2558ad6d9ccc79bd021c401118058f29a64f9dd341a5df01713dec444233b8fabc9ce2bdb0e1205eadee16073491d49d6

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    4c33dae77344b7638d931fa30cd05c85

    SHA1

    feec33faee3ae81ed5b683f08f5528bb4f17fcc4

    SHA256

    69ef5425208fe4cde152f215cb9808dd6fc0272d40eb5a7481b24a05ab3d3515

    SHA512

    144ff3d1e674ccdb7059355851070efbba49a1f2f9ac2330d07a0434253beea5f1fbfe21ad597c84bf741a21b810300e89c62a739f5d60ff2e1c23a6d2275fe2

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    21244f659f4c5a54ed6643ab0103a0cc

    SHA1

    cfbef431572291a090b4bb71211e1774aeea8464

    SHA256

    ab3f35d1cc7b8b0e4fe653f64ebedb196a578375fd3823abddec0d72f683cd4a

    SHA512

    b3f497b4af61afb66a0bdcaca86c339138addc1a524b47246379869d9fce4f744017a1ff437751f800d8717cad61501d760b55db50c43713cdeab16e90a242a7

    Download Submit

  • memory/2468-30-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2468-37-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2468-40-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3448-29-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/5064-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/5064-18-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/5064-23-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/5064-22-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download