Overview

overview

8

Static

static

3

virussign....30.exe

windows7-x64

8

virussign....30.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 18:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    virussign.com_78427af5136989732c00f478e35ace30.exe

  • Size

    127KB

  • MD5

    78427af5136989732c00f478e35ace30

  • SHA1

    185b786c985be80bb74516fc05d4b073b698105d

  • SHA256

    6ceede0311f907efb2d381fd970e21f3011c20aea63869063fe1495434d396e2

  • SHA512

    0cdd80a90bbd7e0feb8e85da563830d036d0736a5d63b1ab8c52325253aa718bf74dd50f6e18386fc025238e13fc32aac3bd3721e498ca22dd676b78487da307

  • SSDEEP

    3072:JOjWuyt0ZHqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPL:JIH9OKofHfHTXQLzgvnzHPowYbvrjD/O

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\virussign.com_78427af5136989732c00f478e35ace30.exe
    "C:\Users\Admin\AppData\Local\Temp\virussign.com_78427af5136989732c00f478e35ace30.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    f6e0e1eb4033b0637eee1f52c682c2f7

    SHA1

    ae15392359268222ddd473eed2f75d0d27116370

    SHA256

    2923d09f3ab26831dfd74bb306d8128e15effc7afa8cea46f5062f62ee159620

    SHA512

    c4ca0d441778b2056aff9aa8a700e7db96045be62acc2fb0372c8ac29f2d5bc530c306e9e4bc9a3e61820bc5be3b7a118857d1f088d1d2c8a4ddc62fa7318afe

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    b5e8b2fdde292160da4434d4e0598225

    SHA1

    68c98d195421e25edffdc061837b40efdfd26ac4

    SHA256

    709da71c10b846198d2aeed487fc64865da161eac5fca2ae7330df581c2f649a

    SHA512

    79b4a06272cdf7f547620ba8f2199cdbdada37e27f4f690779e229c90728f88811a22eb23aab322b2c8fefc99681778b18a196d463c810a6cd9f9a8c283904a6

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    d0cb2ddfccbf3dad0af7e1a0e430d39a

    SHA1

    bc3f55810fc382904636b3a404856fa384d00e2d

    SHA256

    55f0691c0b51422c8ff2d82bf54f2ef49395595de868d65c450d40e2cf27888f

    SHA512

    c5fadaaffd66f112b6965db333a88c0817be23dd44a7d83ed6414e9a51761571ef10c5e6d4df182d05c88a76a9e3ec6b7adf97c0f021a76e9d7934571edb4e06

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    127KB

    MD5

    7d35d1e481d14d7175dc056436d5c7da

    SHA1

    c3465bd944e524c5453fff29273c87c92b15fb37

    SHA256

    f3713511619dc4c960e70ff36d318f80b82e53aa63e73f952e321ce036d64f66

    SHA512

    b64c4eb3a24111f4239be3827fe3ee39e3b67fd2eea5b1cea2f7275bc326ce83ecce20104adf90f5c754ff28ef1d2e733d7e500af5d217f929185fd9e953d88c

    Download Submit

  • memory/2684-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2868-34-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/2868-41-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2868-44-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/3008-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/3008-0-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/3008-26-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/3008-18-0x0000000000390000-0x0000000000399000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3008-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download