c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6

General

Target

c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Size

118KB
MD5

431ac29fcd9deabd011eb19a342e02e7
SHA1

2d51bf3106a6a524ec5971f5f7c5910c9f478736
SHA256

c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6
SHA512

ed14e7186007bce33979a427251fef7ea254eabf374084014366b696bc0ae82ee545acfb8c9f89e6bb656ea7ee754ffd9b6e081b594c478bcdcf7ac161e6b57b
SSDEEP

3072:4OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:4Is9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score

9^/10

persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1740-0-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
\Windows\SysWOW64\shervans.dll	UPX
behavioral1/memory/1740-16-0x0000000010000000-0x000000001000D000-memory.dmp	UPX
\Windows\SysWOW64\ctfmen.exe	UPX
behavioral1/memory/1740-18-0x0000000000340000-0x0000000000349000-memory.dmp	UPX
behavioral1/memory/1740-26-0x0000000010000000-0x000000001000D000-memory.dmp	UPX
behavioral1/memory/1740-25-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
\Windows\SysWOW64\smnss.exe	UPX
behavioral1/memory/2116-29-0x0000000000320000-0x000000000033F000-memory.dmp	UPX
behavioral1/memory/2116-34-0x0000000000400000-0x0000000000409000-memory.dmp	UPX
behavioral1/memory/2748-38-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2748-42-0x0000000010000000-0x000000001000D000-memory.dmp	UPX
behavioral1/memory/2748-48-0x0000000000400000-0x000000000041F000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\shervans.dll	acprotect

Executes dropped EXE 2 IoCs

Processes:

ctfmen.exesmnss.exe

pid process

2116 ctfmen.exe
2748 smnss.exe

pid	process
2116	ctfmen.exe
2748	smnss.exe

Loads dropped DLL 9 IoCs

Processes:

c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exectfmen.exesmnss.exeWerFault.exe

pid	process
1740	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
1740	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
1740	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
2116	ctfmen.exe
2116	ctfmen.exe
2748	smnss.exe
2568	WerFault.exe
2568	WerFault.exe
2568	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exesmnss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exesmnss.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

Processes:

c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exesmnss.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ctfmen.exe	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File created	C:\Windows\SysWOW64\shervans.dll	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File created	C:\Windows\SysWOW64\satornas.dll	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\grcopy.dll	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File created	C:\Windows\SysWOW64\smnss.exe	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe

Drops file in Program Files directory 64 IoCs

Processes:

smnss.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	smnss.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	smnss.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2568 2748 WerFault.exe smnss.exe

pid	pid_target	process	target process
2568	2748	WerFault.exe	smnss.exe

Modifies registry class 6 IoCs

Processes:

c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exesmnss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

smnss.exe

description pid process

Token: SeDebugPrivilege 2748 smnss.exe

description	pid	process
Token: SeDebugPrivilege	2748	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exectfmen.exesmnss.exe

description	pid	process	target process
PID 1740 wrote to memory of 2116	1740	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe	ctfmen.exe
PID 1740 wrote to memory of 2116	1740	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe	ctfmen.exe
PID 1740 wrote to memory of 2116	1740	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe	ctfmen.exe
PID 1740 wrote to memory of 2116	1740	c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe	ctfmen.exe
PID 2116 wrote to memory of 2748	2116	ctfmen.exe	smnss.exe
PID 2116 wrote to memory of 2748	2116	ctfmen.exe	smnss.exe
PID 2116 wrote to memory of 2748	2116	ctfmen.exe	smnss.exe
PID 2116 wrote to memory of 2748	2116	ctfmen.exe	smnss.exe
PID 2748 wrote to memory of 2568	2748	smnss.exe	WerFault.exe
PID 2748 wrote to memory of 2568	2748	smnss.exe	WerFault.exe
PID 2748 wrote to memory of 2568	2748	smnss.exe	WerFault.exe
PID 2748 wrote to memory of 2568	2748	smnss.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe
"C:\Users\Admin\AppData\Local\Temp\c18318919937d441115758cd5b65f821f791af3ad4a47d8f679f40717157d1a6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\ctfmen.exe
ctfmen.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\smnss.exe
C:\Windows\system32\smnss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 840
4⤵
- Loads dropped DLL
- Program crash
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\satornas.dll
Filesize
183B

MD5
b6d5b7cb1dbf7e81d1d2b06e68732aa5

SHA1
db32261bbe600c39c256b9b8695de30522c0a953

SHA256
816c42bfc185d8ffbf84b298374f3b085ecd77700e1861b11d0f170188968600

SHA512
2ffa1178a064b290e91bad551bc18b134079f7b164cd0c9dade12135518831726246f7356366aa1484a7d9a36465601f805833d705349c55297981819a749f51

Download Submit
\Windows\SysWOW64\ctfmen.exe
Filesize
4KB

MD5
47cfb4e4be75616b8eab7575ed28880d

SHA1
d8592b6dd9725397c90da40365eeae3b9e2a5a02

SHA256
fdb8998ac6cedec9f0f8591d193ba19cda829b1a9b1559781e5a342f4bda28e1

SHA512
c622a653b0e1d08c81ee01c1b958785a0bb465f5dd745bb498dca4ec8ce30935ae4c35759241a0f543687e0d66f29956e03b4b5bc4fadf5b61859ce6f83a7158

Download Submit
\Windows\SysWOW64\shervans.dll
Filesize
8KB

MD5
e2dbd1f1aa08dc10baedb7f92452719d

SHA1
75aef6cf8c23e6d139b51fb78384e3412bed7847

SHA256
cc5b2dcd1c8e6479636a1821183425664449ee099b8298e85ae48afa46180e41

SHA512
95505b8cfbcf07fe1c123e1cf44d8dbfc88dd9b65c60ac46c17c858c52a912bfffdc793a99e441c41cca265d3c7c90c880328b4ceff1aa05ea062bd37630ad2d

Download Submit
\Windows\SysWOW64\smnss.exe
Filesize
118KB

MD5
f6e0dd70fd09466933138078522c445e

SHA1
776cee8cbcc47df2de7d1db3556cb8c00209b318

SHA256
b67a22bf66d68e093ca49accc391a733c7a0743b1aedf2c05116e688ee30ba4f

SHA512
8865af45e1a0c3d8ca49f88b6a2eac07ef9c06b98307f03d81a19c6f1b9a5dcc818b1a36aa24de2a0dda6bbf4aec7a6ddc616e167e1ab2606f6995e40ada1fcc

Download Submit
memory/1740-25-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1740-26-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1740-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1740-18-0x0000000000340000-0x0000000000349000-memory.dmp

Filesize
36KB

Download
memory/1740-16-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2116-29-0x0000000000320000-0x000000000033F000-memory.dmp

Filesize
124KB

Download
memory/2116-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2748-38-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2748-42-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2748-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads