Overview

overview

10

Static

static

10

fe4ebe30de...1c.exe

windows7-x64

9

fe4ebe30de...1c.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 05:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fe4ebe30de81abb7db20479092cc0a6df022aa78c3f1b68450df82bde6c6841c.exe

  • Size

    119KB

  • MD5

    648a36cd3542b3fef7218bbf5ee7b957

  • SHA1

    e4c2cd7da019524d047b4851659278a225300368

  • SHA256

    fe4ebe30de81abb7db20479092cc0a6df022aa78c3f1b68450df82bde6c6841c

  • SHA512

    67ffb9f9da6f12a61112d5bd315a03e5533dfeca6bd8952e8768268c82e540f05f530f164c2466407ea94189ac56df7928150061aaa07329328ebe43fbce5370

  • SSDEEP

    3072:YOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:YIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 12 IoCs
  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe4ebe30de81abb7db20479092cc0a6df022aa78c3f1b68450df82bde6c6841c.exe
    "C:\Users\Admin\AppData\Local\Temp\fe4ebe30de81abb7db20479092cc0a6df022aa78c3f1b68450df82bde6c6841c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    6d2fed48e39e20812025be24f5a47e98

    SHA1

    7c551037f937e2a0c956e18bd0c5a76119b637b4

    SHA256

    d6f896510a274e90e5707e2c2814e705cc08f275fc60d6470d3e854d39ae0ad5

    SHA512

    52e0fccd76991ba33766d08221793a93ec2ec058dee1caa76a4f1349e57ece5d3478742f3b5f30b580b3f9bd76dd26af8667bc4b35e42b3c5e7cf0a522258762

    Download Submit
  • C:\Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    c32f1fe4a3fc11315de6fd3115d1cd72

    SHA1

    fdd97be5f5c66614b09262bdf89357c0a89bb180

    SHA256

    e006cfa75151b8484bd6b13ba2297218f563d1c6ebed05faf1526e65f25f1110

    SHA512

    10997d7fbbc563dfa8f82221129c97e79aa136a279ab218faaf1971508b2d50508cc0cdf450c5bdc976761a41c79e8819b81f622507a52f63f8b88c22ce371a6

    Download Submit
  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    13dc36c69de4f5dc3db752e551eed86c

    SHA1

    af7aecf3138e2fa6e92337798697b3cdb3a296cb

    SHA256

    b163bd66ef5cceaf7cd317bc7d2077ff0323c9f285bdf7d640d133bb0ced642c

    SHA512

    529c2dfee87b8fc70b2c1f0872e02d4bee2e17718a6b31a9f44ca347effc5dc5dbe4b8a542d440f486c34f11c04f6796ac77c3b22a9bcaa034bc0d75aaae1e3f

    Download Submit
  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    46ddbf7873cae7841420ff4c9f25b4c1

    SHA1

    067b5d014adec51dcb7cf33e8df5236de5289bed

    SHA256

    c16fef28f8d7edabf17d9dd46a0c9f6ce4fda7cedddb6364a5421e996e39dd83

    SHA512

    e23ec422974f9681e29e8489738fd5492e6118e24fbc91907d7b5649fac0fa811fe5d3a8bbab21538bddc2de8e3091956683428a7d09ae6e1698fa9a1fa699b9

    Download Submit
  • memory/1964-34-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1964-41-0x0000000010000000-0x000000001000D000-memory.dmp
    Filesize

    52KB

    Download
  • memory/1964-44-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/2440-27-0x0000000010000000-0x000000001000D000-memory.dmp
    Filesize

    52KB

    Download
  • memory/2440-26-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/2440-18-0x00000000003C0000-0x00000000003C9000-memory.dmp
    Filesize

    36KB

    Download
  • memory/2440-0-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/2440-16-0x0000000010000000-0x000000001000D000-memory.dmp
    Filesize

    52KB

    Download
  • memory/2804-32-0x0000000000400000-0x0000000000409000-memory.dmp
    Filesize

    36KB

    Download