Overview

overview

8

Static

static

3

3b709e0b51...0N.exe

windows7-x64

8

3b709e0b51...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 02:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b709e0b51a88c065fd3ce94b273a8c0N.exe

  • Size

    352KB

  • MD5

    3b709e0b51a88c065fd3ce94b273a8c0

  • SHA1

    760e3d96d374742cdd79885e45130ec7099edbfa

  • SHA256

    c5743e160fc577de7420d7f7986f72d28269404f4a8593b0cc98da2ce7512c68

  • SHA512

    b6caad0b2ff0432ad9589bbaf1ef21f496fce80fc1e3238e6f216d949c25649f714fe238e874314a3b1533bab827b486f8df5d417d1984c45568c16014bccadf

  • SSDEEP

    6144:IIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:RKofHfHTXQLzgvnzHPowYbvrjD/L7QPs

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b709e0b51a88c065fd3ce94b273a8c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\3b709e0b51a88c065fd3ce94b273a8c0N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    59dbe61c533aa8507bb1e7be9528e344

    SHA1

    4a99417dfda73f633188c181350658497dd6c739

    SHA256

    75cbf5581b0751330cb74bf7fdfafb165cb90ca54ae0b34fba648f5bd4db1341

    SHA512

    3da831446cec2fb8420bfb8d1d3e7748b1bc1946d2d342fbc50d327d4ab5017d4dd2b1e7634f74560527ca1ebccb17a00297782de4279c035ed4ae346c60910e

    Download Submit

  • C:\Windows\SysWOW64\grcopy.dll
    Filesize

    352KB

    MD5

    d55b536f621c620f6396f1d62d52ff14

    SHA1

    1f1c5dec2707ff98f8bad55bc5c787810189c187

    SHA256

    332bdd6db6a766c7d0f808fada308f1e838e53f147d53666abda4af22d1bdba1

    SHA512

    ed982939f54221b921953549159a3180a83b5470c8c389ce975d2d585b92bc5c05e08cd95957d907f3304f1358c2653112e567258fada3fbe82c1751d841959b

    Download Submit

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    faf5d6bb31d321db3d99ecc7c18d8eaf

    SHA1

    aedfc6ba20029833610a87817d4af253d6e1f880

    SHA256

    39176e1ab6ca9293d7047a22941a1e3268c0962e020d8cfbf4de43f1fd52dcf8

    SHA512

    93fefdedcda513414a94f1265881ef006b84755a28673c537ed3a3ce371a3de01634d5304d4157f8d120f8e53a9ade7760d5237006f3b88c37d60fe5ca9c87af

    Download Submit

  • C:\Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    006f01ce587be078d1e9169371f060d9

    SHA1

    b5a26fdb925341f9da9a8ac041281c04c3eedde5

    SHA256

    9ad160cbdb9f133ab5ef50b4fc5459f70477ecf0199bff171f84e55c09ed333c

    SHA512

    1f26cb86b967bf54085e8159c136bcdb928e4e27092869cf86a79719ff00c9687de387591927c52e0082af0623c6eb3dd3ff61c2594fd2761fbd0ce163157621

    Download Submit

  • memory/2996-25-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3096-0-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/3096-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/3096-24-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/3096-23-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/4812-31-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/4812-37-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4812-40-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download